General

  • Target

    274722206.exe

  • Size

    1.0MB

  • Sample

    230522-msw8zsfg53

  • MD5

    a8965bf0fc8cb34f75f2a910f441b8dd

  • SHA1

    fcdba6ed90ad6ff32a9f2e18a37c5f7d861e885a

  • SHA256

    afaa90bd7c6d8aaf56ad67b1df2376eda123ac2312ffdf1eddfc826d983d705f

  • SHA512

    f004e69778f67cc94bda5e41f1dbeccc9f496211e967bda5d835d08b6f04ec71b36c1216c90f5bf863f2a0c7c51e92f2b745fd5bfce71775e7744de868782fea

  • SSDEEP

    12288:kMrNy90LkCpO1H+0psHCwvmr8khL+ljhlJ3Gu5Qnmoou+B0ldPvdA+t6R:JyOkCpqDpsHjm/hKx520ocalpvtO

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      274722206.exe

    • Size

      1.0MB

    • MD5

      a8965bf0fc8cb34f75f2a910f441b8dd

    • SHA1

      fcdba6ed90ad6ff32a9f2e18a37c5f7d861e885a

    • SHA256

      afaa90bd7c6d8aaf56ad67b1df2376eda123ac2312ffdf1eddfc826d983d705f

    • SHA512

      f004e69778f67cc94bda5e41f1dbeccc9f496211e967bda5d835d08b6f04ec71b36c1216c90f5bf863f2a0c7c51e92f2b745fd5bfce71775e7744de868782fea

    • SSDEEP

      12288:kMrNy90LkCpO1H+0psHCwvmr8khL+ljhlJ3Gu5Qnmoou+B0ldPvdA+t6R:JyOkCpqDpsHjm/hKx520ocalpvtO

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks