General

  • Target

    4fe7c6edd78b3d223ab69e76908b5473286734cfd09bc3034fa24ce378219df0

  • Size

    1.1MB

  • Sample

    241106-qbtnba1alh

  • MD5

    51d0b3ab82e3de2347042e0fc2a70181

  • SHA1

    b34347a87e7712847e77847743f668541c527f95

  • SHA256

    4fe7c6edd78b3d223ab69e76908b5473286734cfd09bc3034fa24ce378219df0

  • SHA512

    703b78731beb38b8937dea94d4eaef4455026af3a61159d86e9e00be91c6e883254db964236802ada0a93bdbce0cd3298a8804b5e2bd01c10ee4452134c13a83

  • SSDEEP

    24576:xyLKVdNpQsbLSsYr5/iUDjLT160LxwxjnMJ59gQQeSxe:keVvp53Sso5/pPT1FlwRn459sB

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      4fe7c6edd78b3d223ab69e76908b5473286734cfd09bc3034fa24ce378219df0

    • Size

      1.1MB

    • MD5

      51d0b3ab82e3de2347042e0fc2a70181

    • SHA1

      b34347a87e7712847e77847743f668541c527f95

    • SHA256

      4fe7c6edd78b3d223ab69e76908b5473286734cfd09bc3034fa24ce378219df0

    • SHA512

      703b78731beb38b8937dea94d4eaef4455026af3a61159d86e9e00be91c6e883254db964236802ada0a93bdbce0cd3298a8804b5e2bd01c10ee4452134c13a83

    • SSDEEP

      24576:xyLKVdNpQsbLSsYr5/iUDjLT160LxwxjnMJ59gQQeSxe:keVvp53Sso5/pPT1FlwRn459sB

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks