General

  • Target

    2fa8533d496f32f8a2d4591bcacc8d41cbb4187e82edc8b5e60ae2e8f19d3982

  • Size

    542KB

  • Sample

    241105-mcbmcayhrb

  • MD5

    697464e9728be108b0dca3ccf437607b

  • SHA1

    a2be2c05f96564fd31d67fc403fa29c51851ac99

  • SHA256

    2fa8533d496f32f8a2d4591bcacc8d41cbb4187e82edc8b5e60ae2e8f19d3982

  • SHA512

    24670c17e05d19fe52c32a477adf6a8f35965f0a7f324a89c9d7212fc553fc8b362dbdbd09868db50b8a48fc8ad41ef5d79c5d37fff7f55cf1be425fc5a56d0d

  • SSDEEP

    12288:Vs3z13KZAve9F6nc1kBO/nyaR6Y7eQqXNy13Mq5quSmMXLGc:2J3ASe36nc1Ea4QeQqdy1c2fM7Gc

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19048

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      1e5cfff6f14c0bd993b2067265734473bba336502c0c057bbed0429ae659f27c.exe

    • Size

      585KB

    • MD5

      efa015ab2b5f2c15edea59878603ce2a

    • SHA1

      34e1601cea9dc60e38edbe834ae39dda5b482acd

    • SHA256

      1e5cfff6f14c0bd993b2067265734473bba336502c0c057bbed0429ae659f27c

    • SHA512

      98fd423229b47ac6081c872b9778837ea7efe80de24771025a3573396faab50375bac5f8b6345ead1dc9cb79183a18070b8481bf913b8f848e5f5c96838b5ee8

    • SSDEEP

      12288:wMrGy90UE97sKgv1veVpIymuse+6GNJSGH9LRa:myJ9KAJeIxuo6GNJX9LRa

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks