General

  • Target

    b6f49fef0fd7ffcb36590058f19b690607984f51de6874a745e01b861ce82f6f

  • Size

    433KB

  • Sample

    241105-gzbb7svrfz

  • MD5

    ca99dd9d52e6d6a0d449b5e45a137b3e

  • SHA1

    ca49bbdb6b316e058701c735cef30c42cb0d0143

  • SHA256

    b6f49fef0fd7ffcb36590058f19b690607984f51de6874a745e01b861ce82f6f

  • SHA512

    fc0ef1bd93c5241fb9a801879de5c293f005a681272dfb02abc59c00c64266b966aa2ecf504a0643a05a9c29e06fd086c11c84eb146eb10feb6c77e0a47ca3e4

  • SSDEEP

    12288:lMr9y90rlNh0D80s+CfrvJ24xNBNNsuaMWT:UyoBosdVzsN9

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      b6f49fef0fd7ffcb36590058f19b690607984f51de6874a745e01b861ce82f6f

    • Size

      433KB

    • MD5

      ca99dd9d52e6d6a0d449b5e45a137b3e

    • SHA1

      ca49bbdb6b316e058701c735cef30c42cb0d0143

    • SHA256

      b6f49fef0fd7ffcb36590058f19b690607984f51de6874a745e01b861ce82f6f

    • SHA512

      fc0ef1bd93c5241fb9a801879de5c293f005a681272dfb02abc59c00c64266b966aa2ecf504a0643a05a9c29e06fd086c11c84eb146eb10feb6c77e0a47ca3e4

    • SSDEEP

      12288:lMr9y90rlNh0D80s+CfrvJ24xNBNNsuaMWT:UyoBosdVzsN9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks