General

  • Target

    b0df9fb8a49400c9708a6873f317900d698a5760cd05a4823e70cd5e52c4e3c5

  • Size

    1.0MB

  • Sample

    230522-dejlasge8v

  • MD5

    a86543f18bcf1c82a76708447739b4b8

  • SHA1

    1529a2375f04dd798d4d415886f7aa7be485332f

  • SHA256

    b0df9fb8a49400c9708a6873f317900d698a5760cd05a4823e70cd5e52c4e3c5

  • SHA512

    3c97908cd51e651731570baf066854865ba3a3e011b06e684efef05b8e66b5b1e69e79fdea4cbf551c77b13bbbefce4f80bd103937b455350e18d2b4eb786f7a

  • SSDEEP

    24576:NymbOPN9BXyVPFRE1cp3jKmXQDaOjjRtc/4nTw+TX8puvt3:oKO1rXeclsQDaq764nTw+TXGGt

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      b0df9fb8a49400c9708a6873f317900d698a5760cd05a4823e70cd5e52c4e3c5

    • Size

      1.0MB

    • MD5

      a86543f18bcf1c82a76708447739b4b8

    • SHA1

      1529a2375f04dd798d4d415886f7aa7be485332f

    • SHA256

      b0df9fb8a49400c9708a6873f317900d698a5760cd05a4823e70cd5e52c4e3c5

    • SHA512

      3c97908cd51e651731570baf066854865ba3a3e011b06e684efef05b8e66b5b1e69e79fdea4cbf551c77b13bbbefce4f80bd103937b455350e18d2b4eb786f7a

    • SSDEEP

      24576:NymbOPN9BXyVPFRE1cp3jKmXQDaOjjRtc/4nTw+TX8puvt3:oKO1rXeclsQDaq764nTw+TXGGt

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks