General

  • Target

    d24217358f88f4bf763b489dc993683b595ccce94f38c0be37dcfbf26a0067dc

  • Size

    578KB

  • Sample

    241105-d45vtstdpd

  • MD5

    99ef6c46d299a07c5e539edb79368a0e

  • SHA1

    9ae21645f6fa63589539f0e36d5f867d62b4a24a

  • SHA256

    d24217358f88f4bf763b489dc993683b595ccce94f38c0be37dcfbf26a0067dc

  • SHA512

    729b46985b1bcafce4cd6349bb708f772bb54effda82288ff5f41424d71d61ef9b4f6489f24ad8048e1b30c635053c4cbac0efd9edb8bfeda25b0ee31a7aa697

  • SSDEEP

    12288:dMrcy90pqPyx5TCV0ANWMYtXThlIMl8SWUBnfaxQ:pyyAsW8B9JjzwxQ

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.129:19068

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      d24217358f88f4bf763b489dc993683b595ccce94f38c0be37dcfbf26a0067dc

    • Size

      578KB

    • MD5

      99ef6c46d299a07c5e539edb79368a0e

    • SHA1

      9ae21645f6fa63589539f0e36d5f867d62b4a24a

    • SHA256

      d24217358f88f4bf763b489dc993683b595ccce94f38c0be37dcfbf26a0067dc

    • SHA512

      729b46985b1bcafce4cd6349bb708f772bb54effda82288ff5f41424d71d61ef9b4f6489f24ad8048e1b30c635053c4cbac0efd9edb8bfeda25b0ee31a7aa697

    • SSDEEP

      12288:dMrcy90pqPyx5TCV0ANWMYtXThlIMl8SWUBnfaxQ:pyyAsW8B9JjzwxQ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks