General

  • Target

    26bb3f0000769bd3374a956bce78a5d32eb6e677a98c567b717d678fd9831107

  • Size

    1.1MB

  • Sample

    241105-ywenwszpfl

  • MD5

    a965b1b3884f7532c7228f9a731d9999

  • SHA1

    cb13667cda74724e06ade8282dab3e3b8a3cbced

  • SHA256

    26bb3f0000769bd3374a956bce78a5d32eb6e677a98c567b717d678fd9831107

  • SHA512

    c8600288075b78268d5bd9577e8d3a6bc5c6144f5483a8b6e5211d94cf94e9c2780b8f869ad8d94d59107528af3592f8167ffdc0c0420d56a30988817c3a825d

  • SSDEEP

    24576:5yR5IBZu8t0EYzCraeP11alIHeFhx8KqqDKKXl:sR5QZuW+g1XHGhxO

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      26bb3f0000769bd3374a956bce78a5d32eb6e677a98c567b717d678fd9831107

    • Size

      1.1MB

    • MD5

      a965b1b3884f7532c7228f9a731d9999

    • SHA1

      cb13667cda74724e06ade8282dab3e3b8a3cbced

    • SHA256

      26bb3f0000769bd3374a956bce78a5d32eb6e677a98c567b717d678fd9831107

    • SHA512

      c8600288075b78268d5bd9577e8d3a6bc5c6144f5483a8b6e5211d94cf94e9c2780b8f869ad8d94d59107528af3592f8167ffdc0c0420d56a30988817c3a825d

    • SSDEEP

      24576:5yR5IBZu8t0EYzCraeP11alIHeFhx8KqqDKKXl:sR5QZuW+g1XHGhxO

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks