General

  • Target

    f02f5d248a8549a7883a7e63245a6d55b47a7c67a9be691475446085b6e36e83

  • Size

    469KB

  • Sample

    241105-hwwdmswmcs

  • MD5

    984303bcf43e3ce2c0704d38d240d11f

  • SHA1

    80c90bd04a865e09c59c05167fb7dfad2695035b

  • SHA256

    f02f5d248a8549a7883a7e63245a6d55b47a7c67a9be691475446085b6e36e83

  • SHA512

    b7f616cdac06102672baccec769944487df086815ce06abb67582ec42b365c9edc14687d9645c00edcced737cd41555c6ecedc967aa8eef9f8cae0a5e4f378e9

  • SSDEEP

    12288:RMrby90PGgrpY1IMdxcV3ngRMrbSiWW5Wef:2ymrOAV3KMqibVf

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      f02f5d248a8549a7883a7e63245a6d55b47a7c67a9be691475446085b6e36e83

    • Size

      469KB

    • MD5

      984303bcf43e3ce2c0704d38d240d11f

    • SHA1

      80c90bd04a865e09c59c05167fb7dfad2695035b

    • SHA256

      f02f5d248a8549a7883a7e63245a6d55b47a7c67a9be691475446085b6e36e83

    • SHA512

      b7f616cdac06102672baccec769944487df086815ce06abb67582ec42b365c9edc14687d9645c00edcced737cd41555c6ecedc967aa8eef9f8cae0a5e4f378e9

    • SSDEEP

      12288:RMrby90PGgrpY1IMdxcV3ngRMrbSiWW5Wef:2ymrOAV3KMqibVf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks