General

  • Target

    3db3c33024371bb0b7b69afd7bec878c9a4b51bea86300dd2160ce8ddc5ae8c4

  • Size

    1.1MB

  • Sample

    241104-wdqbkatlew

  • MD5

    ec0cbb52d79c5fea837394962a62bae1

  • SHA1

    8b49127e110776dab2ed11af4c731650b3c77c1e

  • SHA256

    3db3c33024371bb0b7b69afd7bec878c9a4b51bea86300dd2160ce8ddc5ae8c4

  • SHA512

    7f013183ab8cb61496b3557fc09e74527189f0abe287746d7f52669b8b2c04157f94a436d67a787620745b4e9aa31c5ada52c948221065f1f934517f8fbd6730

  • SSDEEP

    24576:kyak3M04Jya0as8CGTslhYq2HiezuGO9WuUTsmcjyg5QNv:zRMR0z8CqjdviG02cjygmN

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      3db3c33024371bb0b7b69afd7bec878c9a4b51bea86300dd2160ce8ddc5ae8c4

    • Size

      1.1MB

    • MD5

      ec0cbb52d79c5fea837394962a62bae1

    • SHA1

      8b49127e110776dab2ed11af4c731650b3c77c1e

    • SHA256

      3db3c33024371bb0b7b69afd7bec878c9a4b51bea86300dd2160ce8ddc5ae8c4

    • SHA512

      7f013183ab8cb61496b3557fc09e74527189f0abe287746d7f52669b8b2c04157f94a436d67a787620745b4e9aa31c5ada52c948221065f1f934517f8fbd6730

    • SSDEEP

      24576:kyak3M04Jya0as8CGTslhYq2HiezuGO9WuUTsmcjyg5QNv:zRMR0z8CqjdviG02cjygmN

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks