General

  • Target

    562b213f814916f2d0c71d1de710cb186edcf92628ca149054db37c213864650

  • Size

    753KB

  • Sample

    241106-lypknaydqn

  • MD5

    f56ec16840381a04c84ee869939821dc

  • SHA1

    807fe5d5f710b06db4eae3f088d47468b5225557

  • SHA256

    562b213f814916f2d0c71d1de710cb186edcf92628ca149054db37c213864650

  • SHA512

    57cdda7e01e2ef3e2608fc9465b10a5e78224c8fab136ac88a2e1a54865f6b691e56c997d4216f385ce7e60bc4b4873f657609fb8832c19e8ecad6dc3df325ac

  • SSDEEP

    12288:qMrMy90uVRSBallONcek5Q7JhqduA/MLMqakheOTrj3WipJ3sqCB5qpyMy:OyzlOHQorRA6ay9vOTBgy

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.127:19045

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      562b213f814916f2d0c71d1de710cb186edcf92628ca149054db37c213864650

    • Size

      753KB

    • MD5

      f56ec16840381a04c84ee869939821dc

    • SHA1

      807fe5d5f710b06db4eae3f088d47468b5225557

    • SHA256

      562b213f814916f2d0c71d1de710cb186edcf92628ca149054db37c213864650

    • SHA512

      57cdda7e01e2ef3e2608fc9465b10a5e78224c8fab136ac88a2e1a54865f6b691e56c997d4216f385ce7e60bc4b4873f657609fb8832c19e8ecad6dc3df325ac

    • SSDEEP

      12288:qMrMy90uVRSBallONcek5Q7JhqduA/MLMqakheOTrj3WipJ3sqCB5qpyMy:OyzlOHQorRA6ay9vOTBgy

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks