General

  • Target

    d685d5db4b6196e2f1fc15abe412ecffc5773b781e7692ea4147f1edb752a748

  • Size

    426KB

  • Sample

    241105-szqyfavaqk

  • MD5

    b195da6e735ce572188c1f693fc2f59d

  • SHA1

    314a5a2f348741eb8618577fd888f2e4927e59bc

  • SHA256

    d685d5db4b6196e2f1fc15abe412ecffc5773b781e7692ea4147f1edb752a748

  • SHA512

    218c979f72844b5d57ebd297f054696dc4e068ba714bb9335e024c424195bf94aa1834c4015c7ac9789a6791cdc3a02e7e8d134fcb3a8f82d3023b0b2b22e234

  • SSDEEP

    12288:UzjQgaUDMNigAB7aMMcM8LFbCRJO6ABMlsC0:UzRawcigAFMcMAFbCRe/

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      93cc419ee939602a610353fcff8b4c34960c1b354733c6f8300a7a684f220fb6.exe

    • Size

      477KB

    • MD5

      35109fad95c0dd3b1870089c282a3ba0

    • SHA1

      863793d6244c1267af8e3a3d802190a9bf9cd2cd

    • SHA256

      93cc419ee939602a610353fcff8b4c34960c1b354733c6f8300a7a684f220fb6

    • SHA512

      91d2bd66992eb0d90ca978646412e722ea6c738527843a282818e59f25f26afee1a00003b79fdccbcb00b4213f3a58c55d27cbf993724d2436dbdbce8e695949

    • SSDEEP

      12288:WMrYy90goHgAmSGekkrMZNHNcG8cjaZOz8D:+ygH/mSUkIZNWZ28D

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks