General

  • Target

    741568a6edc2d0dac21f543709a9b3c7133f381eb64f77c3726c8916fa87b4c7

  • Size

    714KB

  • Sample

    241106-mjnkgsxpe1

  • MD5

    ad21674f06502300ecd153762bc24d86

  • SHA1

    601ad14ca380ce6312cf63d007ab495b5d81b450

  • SHA256

    741568a6edc2d0dac21f543709a9b3c7133f381eb64f77c3726c8916fa87b4c7

  • SHA512

    9965da5d53f509f4fff6c5bf406bc37576684d67a698b18a9b7b5762e82a93bbea429043419fe4f3517cb44b43a5faf4ae6cf5ec5499b63e9b3bcb8d2bcc3e0d

  • SSDEEP

    12288:2MrMy90KzMY+H2hNk7s+NSxZeJSBIqTMD5GWX50R/03wgoMaUnadm7K:yyjMJ2A5N6ZwSBIPDkWX6R/8wgohpdmG

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      741568a6edc2d0dac21f543709a9b3c7133f381eb64f77c3726c8916fa87b4c7

    • Size

      714KB

    • MD5

      ad21674f06502300ecd153762bc24d86

    • SHA1

      601ad14ca380ce6312cf63d007ab495b5d81b450

    • SHA256

      741568a6edc2d0dac21f543709a9b3c7133f381eb64f77c3726c8916fa87b4c7

    • SHA512

      9965da5d53f509f4fff6c5bf406bc37576684d67a698b18a9b7b5762e82a93bbea429043419fe4f3517cb44b43a5faf4ae6cf5ec5499b63e9b3bcb8d2bcc3e0d

    • SSDEEP

      12288:2MrMy90KzMY+H2hNk7s+NSxZeJSBIqTMD5GWX50R/03wgoMaUnadm7K:yyjMJ2A5N6ZwSBIPDkWX6R/8wgohpdmG

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks