General

  • Target

    0619a4ed245990b3840d60675eb6284583833db0803be0e22e3006b032961212

  • Size

    468KB

  • Sample

    241105-1z6b5azbld

  • MD5

    4125780ad2da194d1fb703569127de17

  • SHA1

    cfd1ee7a0800bf7f1858f59ec5f7e2b7929a116f

  • SHA256

    0619a4ed245990b3840d60675eb6284583833db0803be0e22e3006b032961212

  • SHA512

    73c3bbec7b0f64ff7b0cf008151c33b102ce2e91fca362fbd77f90cf6eaa889842b9fa957d5a7be1d3a69035e8ed03c784f8581856362f0431e4fb1d8112b08e

  • SSDEEP

    12288:pMrqy90Zm7fHfVn5HKVRzRTmK1CjdnqtWxi:/yAmLVx0WVq7

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      0619a4ed245990b3840d60675eb6284583833db0803be0e22e3006b032961212

    • Size

      468KB

    • MD5

      4125780ad2da194d1fb703569127de17

    • SHA1

      cfd1ee7a0800bf7f1858f59ec5f7e2b7929a116f

    • SHA256

      0619a4ed245990b3840d60675eb6284583833db0803be0e22e3006b032961212

    • SHA512

      73c3bbec7b0f64ff7b0cf008151c33b102ce2e91fca362fbd77f90cf6eaa889842b9fa957d5a7be1d3a69035e8ed03c784f8581856362f0431e4fb1d8112b08e

    • SSDEEP

      12288:pMrqy90Zm7fHfVn5HKVRzRTmK1CjdnqtWxi:/yAmLVx0WVq7

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks