General

  • Target

    4c729081fe4f035d5e0dff8c6d141d996e5da4c872b0fa8210849845762ed342

  • Size

    763KB

  • Sample

    241104-166w8syfrq

  • MD5

    2eed6f34c26fd02b3435634d77a0ea21

  • SHA1

    a886b4026a662f8bc3a726f5e30c982b0370a341

  • SHA256

    4c729081fe4f035d5e0dff8c6d141d996e5da4c872b0fa8210849845762ed342

  • SHA512

    839ef6e7ed538064a3ee74b32f5428bc95c2e62e8f955a913105da4b3536d14495e27a4a6b34f992efb6d57bf79cd9d1bb866af91ea5cd8fa9a88bf0e8809d54

  • SSDEEP

    12288:eMrJy90ktmEgitJZEZv8MqcWZFlp5wc60swa3sTB/4i6ca/H9Bd:Hy5Dt/iv8bp5Bn6iAZ/9Bd

Malware Config

Extracted

Family

redline

Botnet

romik

C2

193.233.20.12:4132

Attributes
  • auth_value

    8fb78d2889ba0ca42678b59b884e88ff

Targets

    • Target

      4c729081fe4f035d5e0dff8c6d141d996e5da4c872b0fa8210849845762ed342

    • Size

      763KB

    • MD5

      2eed6f34c26fd02b3435634d77a0ea21

    • SHA1

      a886b4026a662f8bc3a726f5e30c982b0370a341

    • SHA256

      4c729081fe4f035d5e0dff8c6d141d996e5da4c872b0fa8210849845762ed342

    • SHA512

      839ef6e7ed538064a3ee74b32f5428bc95c2e62e8f955a913105da4b3536d14495e27a4a6b34f992efb6d57bf79cd9d1bb866af91ea5cd8fa9a88bf0e8809d54

    • SSDEEP

      12288:eMrJy90ktmEgitJZEZv8MqcWZFlp5wc60swa3sTB/4i6ca/H9Bd:Hy5Dt/iv8bp5Bn6iAZ/9Bd

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks