General

  • Target

    8a0994ab7f1e69442887c5437709f2c47fbc080fd9104a5eed5825ad21f1e9e0

  • Size

    469KB

  • Sample

    241105-tvtzzatmgv

  • MD5

    56e0220d02d7eb454be1e0dc1f6e4500

  • SHA1

    6eb6cd0a38e765a3bb51be359276cebd3f5a0b7b

  • SHA256

    8a0994ab7f1e69442887c5437709f2c47fbc080fd9104a5eed5825ad21f1e9e0

  • SHA512

    1c62754f11dbefe22de890a61dc33f75b4497b2f563b15f0e64176414e971c95bdad17e75ec5632f2f18931acc9c7a0915bb1e69f297850c1657e470188f4045

  • SSDEEP

    12288:RMrby90mh4UHYmiU5AaKUnuJ832i8dbRbSiWPe:+yxdioAaKIQU2i8Rsi1

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      8a0994ab7f1e69442887c5437709f2c47fbc080fd9104a5eed5825ad21f1e9e0

    • Size

      469KB

    • MD5

      56e0220d02d7eb454be1e0dc1f6e4500

    • SHA1

      6eb6cd0a38e765a3bb51be359276cebd3f5a0b7b

    • SHA256

      8a0994ab7f1e69442887c5437709f2c47fbc080fd9104a5eed5825ad21f1e9e0

    • SHA512

      1c62754f11dbefe22de890a61dc33f75b4497b2f563b15f0e64176414e971c95bdad17e75ec5632f2f18931acc9c7a0915bb1e69f297850c1657e470188f4045

    • SSDEEP

      12288:RMrby90mh4UHYmiU5AaKUnuJ832i8dbRbSiWPe:+yxdioAaKIQU2i8Rsi1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks