General

  • Target

    248990s582.exe

  • Size

    1.0MB

  • Sample

    230521-xdr1tsee61

  • MD5

    7b52c89104609b0caf17b4e94d0f2703

  • SHA1

    bdbbac7557b69e179cb793153788f0a056877bf5

  • SHA256

    3f8a4a1111d716395d53fadd94f4d916fba7737976f3ef5085c1d20b63548412

  • SHA512

    fcd80c21343e8137a44b0776a80305241d6bebb9038125fe2aaf4bed47177ff8d9321b232bd6651db5f7fe692560112d7ce1e8026a2a3d413d86e4d0e5875ed6

  • SSDEEP

    24576:8ydK4bKiPZO69FkKkQ0xKfVsv6xGtAogbhpjPRVECo62HX:rUiP+d0fZbDjPP0

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      248990s582.exe

    • Size

      1.0MB

    • MD5

      7b52c89104609b0caf17b4e94d0f2703

    • SHA1

      bdbbac7557b69e179cb793153788f0a056877bf5

    • SHA256

      3f8a4a1111d716395d53fadd94f4d916fba7737976f3ef5085c1d20b63548412

    • SHA512

      fcd80c21343e8137a44b0776a80305241d6bebb9038125fe2aaf4bed47177ff8d9321b232bd6651db5f7fe692560112d7ce1e8026a2a3d413d86e4d0e5875ed6

    • SSDEEP

      24576:8ydK4bKiPZO69FkKkQ0xKfVsv6xGtAogbhpjPRVECo62HX:rUiP+d0fZbDjPP0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks