General

  • Target

    896-96-0x00000000025E0000-0x0000000002624000-memory.dmp

  • Size

    272KB

  • Sample

    230215-cz79qahf97

  • MD5

    fa45f444fdaf6feb63d8f8d63f00efd3

  • SHA1

    aa51f05776d7084bc2aac9d39c9507c8472aa750

  • SHA256

    1e7b9a72e1e7eb97671e5f58551116fc968129372ca99ebe7da931b803067071

  • SHA512

    31e4c156e268adec9a76db016448a08e46b5b512b1ac4aad7e48621049e4c09b77e881439ba7147e3f1676ef726261005dfacc9159b8a6cff95218ef4beee137

  • SSDEEP

    3072:B6jIELf6FDTCLkYxJw6qxYgcgpiiSo40jm8dAhTrnz5XD1NxNn2pU9f2MKTV/wig:B6jodYx9cYKpzwAAh3nz

Malware Config

Extracted

Family

redline

Botnet

ruma

C2

193.233.20.13:4136

Attributes
  • auth_value

    647d00dfaba082a4a30f383bca5d1a2a

Targets

    • Target

      896-96-0x00000000025E0000-0x0000000002624000-memory.dmp

    • Size

      272KB

    • MD5

      fa45f444fdaf6feb63d8f8d63f00efd3

    • SHA1

      aa51f05776d7084bc2aac9d39c9507c8472aa750

    • SHA256

      1e7b9a72e1e7eb97671e5f58551116fc968129372ca99ebe7da931b803067071

    • SHA512

      31e4c156e268adec9a76db016448a08e46b5b512b1ac4aad7e48621049e4c09b77e881439ba7147e3f1676ef726261005dfacc9159b8a6cff95218ef4beee137

    • SSDEEP

      3072:B6jIELf6FDTCLkYxJw6qxYgcgpiiSo40jm8dAhTrnz5XD1NxNn2pU9f2MKTV/wig:B6jodYx9cYKpzwAAh3nz

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

MITRE ATT&CK Matrix

Tasks