General

  • Target

    3f0b0debaaec0407e12c658ada65317db551e7b3be2e17df2f149da7128720b7

  • Size

    785KB

  • Sample

    230921-lgap6shb52

  • MD5

    bc0c3e5cb3382d9d82fdacd83905fe12

  • SHA1

    3a85f43db86128e8d770bdee2f52a6db44432a17

  • SHA256

    3f0b0debaaec0407e12c658ada65317db551e7b3be2e17df2f149da7128720b7

  • SHA512

    20488a4be8e3a4010abbe6db3d8386e22dc79d51585060b7d42e691e955c7898473c9f3c924da9d3668dc5cc63ea7e7f3a7026e5cbfc096194fb964421ff290a

  • SSDEEP

    24576:jyqwyQxnHk6YfsFmj+aPxpokkTrOjjTfm:25oN5V5povqjTf

Malware Config

Extracted

Family

redline

Botnet

buben

C2

77.91.124.82:19071

Attributes
  • auth_value

    c62fa04aa45f5b78f62d2c21fcbefdec

Targets

    • Target

      3f0b0debaaec0407e12c658ada65317db551e7b3be2e17df2f149da7128720b7

    • Size

      785KB

    • MD5

      bc0c3e5cb3382d9d82fdacd83905fe12

    • SHA1

      3a85f43db86128e8d770bdee2f52a6db44432a17

    • SHA256

      3f0b0debaaec0407e12c658ada65317db551e7b3be2e17df2f149da7128720b7

    • SHA512

      20488a4be8e3a4010abbe6db3d8386e22dc79d51585060b7d42e691e955c7898473c9f3c924da9d3668dc5cc63ea7e7f3a7026e5cbfc096194fb964421ff290a

    • SSDEEP

      24576:jyqwyQxnHk6YfsFmj+aPxpokkTrOjjTfm:25oN5V5povqjTf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks