General

  • Target

    5dc51ec618df43ed6fc824ec30c25e83727b037b45d1fda300163fbe443c6428

  • Size

    1.1MB

  • Sample

    241105-1le8sa1rfk

  • MD5

    acd37f485fb48c160af06750e9f517f2

  • SHA1

    c9477322f2aee3a78a4f4ca15f42333e529615f0

  • SHA256

    5dc51ec618df43ed6fc824ec30c25e83727b037b45d1fda300163fbe443c6428

  • SHA512

    2743bf165984e7e859d80f7366f1794f863654f48e2e0f0b69c303ecd9388137284ddaac96afc1c3ad08d70d73bd0ff46ab19ff74365042c51a3016ecf40bd46

  • SSDEEP

    24576:ryrmSSsjn1hA5Dhl6nDf3qhdwa5gvJiDHqQf1LP9dX938AGj:eLbnAED/IKJiDH/f1LlDw

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      5dc51ec618df43ed6fc824ec30c25e83727b037b45d1fda300163fbe443c6428

    • Size

      1.1MB

    • MD5

      acd37f485fb48c160af06750e9f517f2

    • SHA1

      c9477322f2aee3a78a4f4ca15f42333e529615f0

    • SHA256

      5dc51ec618df43ed6fc824ec30c25e83727b037b45d1fda300163fbe443c6428

    • SHA512

      2743bf165984e7e859d80f7366f1794f863654f48e2e0f0b69c303ecd9388137284ddaac96afc1c3ad08d70d73bd0ff46ab19ff74365042c51a3016ecf40bd46

    • SSDEEP

      24576:ryrmSSsjn1hA5Dhl6nDf3qhdwa5gvJiDHqQf1LP9dX938AGj:eLbnAED/IKJiDH/f1LlDw

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks