General

  • Target

    baa3f3ae7b9f0bd13de207a7050b183abeca4ce58657ad99f1915e06e1e6a286

  • Size

    578KB

  • Sample

    241106-r5hnksvjdn

  • MD5

    c50799711ce8dc440be02ff22284d793

  • SHA1

    6415a306b36cbb303a86f86c63f6167d6a04a815

  • SHA256

    baa3f3ae7b9f0bd13de207a7050b183abeca4ce58657ad99f1915e06e1e6a286

  • SHA512

    f40737a9f605b6cddc3dccdf310c4075efd5cfdcdb0d289a31498a17ecf323add8cfc2bd81d916dae00134d126b6b4aa130233737cd66a3266b172295c9d7b4e

  • SSDEEP

    12288:HMrfy90YM7u1XIr1fw6wClvWlPOdHHAZQoOWFsD:Yyn8u1YiQdWloHHAzFo

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.129:19068

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      baa3f3ae7b9f0bd13de207a7050b183abeca4ce58657ad99f1915e06e1e6a286

    • Size

      578KB

    • MD5

      c50799711ce8dc440be02ff22284d793

    • SHA1

      6415a306b36cbb303a86f86c63f6167d6a04a815

    • SHA256

      baa3f3ae7b9f0bd13de207a7050b183abeca4ce58657ad99f1915e06e1e6a286

    • SHA512

      f40737a9f605b6cddc3dccdf310c4075efd5cfdcdb0d289a31498a17ecf323add8cfc2bd81d916dae00134d126b6b4aa130233737cd66a3266b172295c9d7b4e

    • SSDEEP

      12288:HMrfy90YM7u1XIr1fw6wClvWlPOdHHAZQoOWFsD:Yyn8u1YiQdWloHHAzFo

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks