General

  • Target

    3307aaeacfba7686219df9c275ec318876ddd8e3714c6ba428d492cd40bf7b0c

  • Size

    541KB

  • Sample

    241107-dvr8datla1

  • MD5

    49ade5ac25d008ee754aa05aeb30f99d

  • SHA1

    c0f75ece390bb0cc82da9f2270e2064bbe0161bd

  • SHA256

    3307aaeacfba7686219df9c275ec318876ddd8e3714c6ba428d492cd40bf7b0c

  • SHA512

    eefcb5d113f36d070d7a788333efafb6f1f488632e9ad84b0a66a195cd7662d4ec22c2b8bbb57c6c5a4d2ccdca3ff799ccc23bfc76b328124017eda98f40af32

  • SSDEEP

    12288:PGlMIs3AqFbQkRC0Iikh411coMkp3SOt/haR81my6JjZrmoe:PEoA+b3RtI74UoMC3/kR2aaN

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19048

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      94697578ac7adb140d5144617210f26f71ccb12a99002c7221bd1bda822c5370.exe

    • Size

      585KB

    • MD5

      718bfc791370de0adf014c0327a9eaa5

    • SHA1

      1f2612a3d78e65de634613ddfda30bfae0b9718f

    • SHA256

      94697578ac7adb140d5144617210f26f71ccb12a99002c7221bd1bda822c5370

    • SHA512

      aca17bb2e1e703c77901127ff587fb053a47726aff9b8cba5739fffc08b1be477e06eb7b683fe9577426b47ff9650bfa8611a48bf5487e2aba89ebbcbb542580

    • SSDEEP

      12288:1Mrey902X5jxl48hJKKLsZHMl1RDKzsD8am6mropt+SC:/yhxl3YKLSMlHKzS8a2ron+X

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks