General

  • Target

    3e92c49f0f00e96ea33adce151f5c8e45d99bbb6df4fc47878bcf638ecaa56ef

  • Size

    785KB

  • Sample

    230921-jvgpjagf67

  • MD5

    89efee6a2fc51ea8e21800bfb74f57da

  • SHA1

    fc145e355fde7ad7f047ca6ab9d5bde41f3f775a

  • SHA256

    3e92c49f0f00e96ea33adce151f5c8e45d99bbb6df4fc47878bcf638ecaa56ef

  • SHA512

    ac61cf7e41913064be5353f303fc1c5fee0173d136162fa84972cefec7008c4c6392ff1a1d39f0fff6c2d5ef458e76e3b2570720fa0bce871d224559654daa11

  • SSDEEP

    12288:MMrky90mIQYYVHyilOhQoLPwbf2jVOERMV+HN6ElIkDsN5+YR080WpO2uIZlFbh:oy9EYV/lObtdRA+t61PP+YR08TO7Eh

Malware Config

Extracted

Family

redline

Botnet

buben

C2

77.91.124.82:19071

Attributes
  • auth_value

    c62fa04aa45f5b78f62d2c21fcbefdec

Targets

    • Target

      3e92c49f0f00e96ea33adce151f5c8e45d99bbb6df4fc47878bcf638ecaa56ef

    • Size

      785KB

    • MD5

      89efee6a2fc51ea8e21800bfb74f57da

    • SHA1

      fc145e355fde7ad7f047ca6ab9d5bde41f3f775a

    • SHA256

      3e92c49f0f00e96ea33adce151f5c8e45d99bbb6df4fc47878bcf638ecaa56ef

    • SHA512

      ac61cf7e41913064be5353f303fc1c5fee0173d136162fa84972cefec7008c4c6392ff1a1d39f0fff6c2d5ef458e76e3b2570720fa0bce871d224559654daa11

    • SSDEEP

      12288:MMrky90mIQYYVHyilOhQoLPwbf2jVOERMV+HN6ElIkDsN5+YR080WpO2uIZlFbh:oy9EYV/lObtdRA+t61PP+YR08TO7Eh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks