General

  • Target

    34d6aa78b361ccdf4e5fa9616d2dc609ca3ac5baaf2db595f4fdd2e78b0adf56

  • Size

    469KB

  • Sample

    241105-kn5y8a1jbq

  • MD5

    c3a7a6828ccffc5627942d4afdf947b4

  • SHA1

    806b55212d638b32f1042461bb47c7f080807fd8

  • SHA256

    34d6aa78b361ccdf4e5fa9616d2dc609ca3ac5baaf2db595f4fdd2e78b0adf56

  • SHA512

    92114da276b4c00b0a181b2564325d406c3074c3cafffb26aee0c8c1a667be05d9a6b39ba86f0e75ab9ecf5149f3363e24a34bfa0e04709bec7cbc441297005e

  • SSDEEP

    12288:OMrDy90SWCfegR8JLI+CpUwvne9F245W:RyhWCmpJLupUoKF240

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      34d6aa78b361ccdf4e5fa9616d2dc609ca3ac5baaf2db595f4fdd2e78b0adf56

    • Size

      469KB

    • MD5

      c3a7a6828ccffc5627942d4afdf947b4

    • SHA1

      806b55212d638b32f1042461bb47c7f080807fd8

    • SHA256

      34d6aa78b361ccdf4e5fa9616d2dc609ca3ac5baaf2db595f4fdd2e78b0adf56

    • SHA512

      92114da276b4c00b0a181b2564325d406c3074c3cafffb26aee0c8c1a667be05d9a6b39ba86f0e75ab9ecf5149f3363e24a34bfa0e04709bec7cbc441297005e

    • SSDEEP

      12288:OMrDy90SWCfegR8JLI+CpUwvne9F245W:RyhWCmpJLupUoKF240

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks