General

  • Target

    bca27eb2d3c4a65a98be36229e8fd93b3ae9ee3c64e2899fa71036c22446990b

  • Size

    1.0MB

  • Sample

    230522-a2nlzsdb48

  • MD5

    f6841534612e72e603d403927f74a403

  • SHA1

    ff3542ae69c7ba43cbe4bf8f0b073763e37befb3

  • SHA256

    bca27eb2d3c4a65a98be36229e8fd93b3ae9ee3c64e2899fa71036c22446990b

  • SHA512

    8ba65c020899ef4b7ebbe844a81cb9015dcacc5c053128c0cd1f5f5460c84d4e340e4e25e1114f1e50ed7f3a3cf3d473fa371f18a292270befbfd3b12b475790

  • SSDEEP

    24576:Iy4s/zOQLs7lp1LNlARY2auYia/xxE2QUz8P+WTex94Cf2l:PLSe0dWC/xxlQUz8P3TeX47

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      bca27eb2d3c4a65a98be36229e8fd93b3ae9ee3c64e2899fa71036c22446990b

    • Size

      1.0MB

    • MD5

      f6841534612e72e603d403927f74a403

    • SHA1

      ff3542ae69c7ba43cbe4bf8f0b073763e37befb3

    • SHA256

      bca27eb2d3c4a65a98be36229e8fd93b3ae9ee3c64e2899fa71036c22446990b

    • SHA512

      8ba65c020899ef4b7ebbe844a81cb9015dcacc5c053128c0cd1f5f5460c84d4e340e4e25e1114f1e50ed7f3a3cf3d473fa371f18a292270befbfd3b12b475790

    • SSDEEP

      24576:Iy4s/zOQLs7lp1LNlARY2auYia/xxE2QUz8P+WTex94Cf2l:PLSe0dWC/xxlQUz8P3TeX47

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks