General

  • Target

    b513d7c607c40aafe1d7fb7dd927c96bf813b969d4984c4826377334d9123872

  • Size

    476KB

  • Sample

    241106-q2f5xa1dpa

  • MD5

    5630d6d50f03a95e457bd9536101ad76

  • SHA1

    af3cdcd099950012cca436861cd7e14a7c4ae389

  • SHA256

    b513d7c607c40aafe1d7fb7dd927c96bf813b969d4984c4826377334d9123872

  • SHA512

    3bd6564ea49848d874f6026b8e69002dde850229adfe9225665b043080e148f1be2b8a453005ef346a16ddaef8f37385b52ccbff27cef69496a6c47e8f970e50

  • SSDEEP

    12288:zMrky90tZfeLDbKkx3u2DsqB/NMk8M2m6gXb3ax:by8uXKkx+zk/C/gX2x

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      b513d7c607c40aafe1d7fb7dd927c96bf813b969d4984c4826377334d9123872

    • Size

      476KB

    • MD5

      5630d6d50f03a95e457bd9536101ad76

    • SHA1

      af3cdcd099950012cca436861cd7e14a7c4ae389

    • SHA256

      b513d7c607c40aafe1d7fb7dd927c96bf813b969d4984c4826377334d9123872

    • SHA512

      3bd6564ea49848d874f6026b8e69002dde850229adfe9225665b043080e148f1be2b8a453005ef346a16ddaef8f37385b52ccbff27cef69496a6c47e8f970e50

    • SSDEEP

      12288:zMrky90tZfeLDbKkx3u2DsqB/NMk8M2m6gXb3ax:by8uXKkx+zk/C/gX2x

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks