General

  • Target

    c4f75cb21ef9bd71cb451bf404740a977086f19b67cff1b6bbdd5b97abea7658

  • Size

    477KB

  • Sample

    241104-2pcsha1pdk

  • MD5

    5c82f05c3d6d0e5d34bacef70db0fb3e

  • SHA1

    4c83a980b6c94b2e9489c7139732c94991eb049e

  • SHA256

    c4f75cb21ef9bd71cb451bf404740a977086f19b67cff1b6bbdd5b97abea7658

  • SHA512

    2f053d2c09d314cd54d180395bb1e7e82cc64c57347dec14157740afea790fabb32424e5f5ac42dcf38060f73821ba160d6dfc666820960a8bbf9a4fec896063

  • SSDEEP

    12288:KMrTy90CHK1tmuE5eyEZASgJO3Dbv4l+8o/d6:5yXHK10FeyETlTbN5/d6

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      c4f75cb21ef9bd71cb451bf404740a977086f19b67cff1b6bbdd5b97abea7658

    • Size

      477KB

    • MD5

      5c82f05c3d6d0e5d34bacef70db0fb3e

    • SHA1

      4c83a980b6c94b2e9489c7139732c94991eb049e

    • SHA256

      c4f75cb21ef9bd71cb451bf404740a977086f19b67cff1b6bbdd5b97abea7658

    • SHA512

      2f053d2c09d314cd54d180395bb1e7e82cc64c57347dec14157740afea790fabb32424e5f5ac42dcf38060f73821ba160d6dfc666820960a8bbf9a4fec896063

    • SSDEEP

      12288:KMrTy90CHK1tmuE5eyEZASgJO3Dbv4l+8o/d6:5yXHK10FeyETlTbN5/d6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks