General

  • Target

    20715a748df4ff5b117d76ad7e95e9182586b26480740780150bbcbb6f9c8b3d

  • Size

    477KB

  • Sample

    241107-cgwszavpbp

  • MD5

    82d662487d753a7bd699ace158f6cf12

  • SHA1

    11777e1f5b8f0340e23bdcc48639329d384b68be

  • SHA256

    20715a748df4ff5b117d76ad7e95e9182586b26480740780150bbcbb6f9c8b3d

  • SHA512

    2677df634aa749fe65bf6e380aa38888f71d27d266829f3f95bbdecbe2a2356dc6606104cf179ec0c18151a9f7d766146827d0906a076a8f18f0a3f23ccf1cb0

  • SSDEEP

    12288:MMrmy90nvy6R8Gig2pxsMgAKWg9PlNqmiFK1cW:yywvy6GGigqBgvWg4lK1cW

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      20715a748df4ff5b117d76ad7e95e9182586b26480740780150bbcbb6f9c8b3d

    • Size

      477KB

    • MD5

      82d662487d753a7bd699ace158f6cf12

    • SHA1

      11777e1f5b8f0340e23bdcc48639329d384b68be

    • SHA256

      20715a748df4ff5b117d76ad7e95e9182586b26480740780150bbcbb6f9c8b3d

    • SHA512

      2677df634aa749fe65bf6e380aa38888f71d27d266829f3f95bbdecbe2a2356dc6606104cf179ec0c18151a9f7d766146827d0906a076a8f18f0a3f23ccf1cb0

    • SSDEEP

      12288:MMrmy90nvy6R8Gig2pxsMgAKWg9PlNqmiFK1cW:yywvy6GGigqBgvWg4lK1cW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks