General

  • Target

    f1a5cb3d65415fd264e720e5853d9df0646c230f0ff8f1e4af40cfefce3ac2f8

  • Size

    1.0MB

  • Sample

    230522-edpxcsdh83

  • MD5

    0e7fd4e7a0fd05c8208f27a3276eb042

  • SHA1

    5a2d9c2b90969502e50b6b8229621faaabdada75

  • SHA256

    f1a5cb3d65415fd264e720e5853d9df0646c230f0ff8f1e4af40cfefce3ac2f8

  • SHA512

    6c7043c637d2d180bba8401491efaed150d5c663d499c8325098e69dc4d6ac0c4f5b78e8a9188deae325ef40e0dcf82fe77de10f4329f3447292fe4dd20a0908

  • SSDEEP

    24576:XyySBHEjgQGT0EBpKwggXzlQpjpRmcdJmTff:iyUH7QGv/1ggjloxETf

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      f1a5cb3d65415fd264e720e5853d9df0646c230f0ff8f1e4af40cfefce3ac2f8

    • Size

      1.0MB

    • MD5

      0e7fd4e7a0fd05c8208f27a3276eb042

    • SHA1

      5a2d9c2b90969502e50b6b8229621faaabdada75

    • SHA256

      f1a5cb3d65415fd264e720e5853d9df0646c230f0ff8f1e4af40cfefce3ac2f8

    • SHA512

      6c7043c637d2d180bba8401491efaed150d5c663d499c8325098e69dc4d6ac0c4f5b78e8a9188deae325ef40e0dcf82fe77de10f4329f3447292fe4dd20a0908

    • SSDEEP

      24576:XyySBHEjgQGT0EBpKwggXzlQpjpRmcdJmTff:iyUH7QGv/1ggjloxETf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks