General

  • Target

    effa38c2b17fdbb9bf10adc2d115127340d47891e8702c23dd407c93bd7b28ee

  • Size

    751KB

  • Sample

    241105-m1bx1sslgk

  • MD5

    b7a5a5c0b3bfb38a823095db3b6f9413

  • SHA1

    655200af11a4c7cc10bd0ae61025f03050e0f9cd

  • SHA256

    effa38c2b17fdbb9bf10adc2d115127340d47891e8702c23dd407c93bd7b28ee

  • SHA512

    ccf1ea79e0be1ac594e5eb114e788984971c4fd3602c18fff375c542f06b2104f3f3863c972ad178105828d16b9f16dd4ae74fbb84b0d93e8d05d2bc1e7b0639

  • SSDEEP

    12288:qMrUy90KMVU+60BrWp/S+nfv4R6ZxUlPz6mlzil3CWGQRBD1XCdLgyLxjo9qr/dT:Wy3z0QzX40ENz6EzyrDZ4LgyLxcEsGX3

Malware Config

Extracted

Family

redline

Botnet

dars

C2

83.97.73.127:19045

Attributes
  • auth_value

    7cd208e6b6c927262304d5d4d88647fd

Targets

    • Target

      effa38c2b17fdbb9bf10adc2d115127340d47891e8702c23dd407c93bd7b28ee

    • Size

      751KB

    • MD5

      b7a5a5c0b3bfb38a823095db3b6f9413

    • SHA1

      655200af11a4c7cc10bd0ae61025f03050e0f9cd

    • SHA256

      effa38c2b17fdbb9bf10adc2d115127340d47891e8702c23dd407c93bd7b28ee

    • SHA512

      ccf1ea79e0be1ac594e5eb114e788984971c4fd3602c18fff375c542f06b2104f3f3863c972ad178105828d16b9f16dd4ae74fbb84b0d93e8d05d2bc1e7b0639

    • SSDEEP

      12288:qMrUy90KMVU+60BrWp/S+nfv4R6ZxUlPz6mlzil3CWGQRBD1XCdLgyLxjo9qr/dT:Wy3z0QzX40ENz6EzyrDZ4LgyLxcEsGX3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks