General

  • Target

    fa7e9ff1393339b16acb50499a5a28a24de26a9294f975110d1f5ae849dcd1be

  • Size

    469KB

  • Sample

    241106-3jv8bszjfw

  • MD5

    53f351045cc1b3906d3ae07fd92307d8

  • SHA1

    a440989f2dd3b09672602295ca415f29a08f688b

  • SHA256

    fa7e9ff1393339b16acb50499a5a28a24de26a9294f975110d1f5ae849dcd1be

  • SHA512

    e8375c781a8d7b3318304e1d2803fe41d4b945392c1fdac623a620f677d61a91d012868c899901fdf2914eed2c947b554f2c57d1aaac530564475f9076572f0a

  • SSDEEP

    6144:Kay+bnr+Jnp0yN90QEkEL4VJ0wM+DMHK84GkCroFyxMikJFgEFpTx+c:KMr9y90yELcqw7uX4GkhFy0FNFtsc

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      fa7e9ff1393339b16acb50499a5a28a24de26a9294f975110d1f5ae849dcd1be

    • Size

      469KB

    • MD5

      53f351045cc1b3906d3ae07fd92307d8

    • SHA1

      a440989f2dd3b09672602295ca415f29a08f688b

    • SHA256

      fa7e9ff1393339b16acb50499a5a28a24de26a9294f975110d1f5ae849dcd1be

    • SHA512

      e8375c781a8d7b3318304e1d2803fe41d4b945392c1fdac623a620f677d61a91d012868c899901fdf2914eed2c947b554f2c57d1aaac530564475f9076572f0a

    • SSDEEP

      6144:Kay+bnr+Jnp0yN90QEkEL4VJ0wM+DMHK84GkCroFyxMikJFgEFpTx+c:KMr9y90yELcqw7uX4GkhFy0FNFtsc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks