General

  • Target

    3bff47b7e9871173cacf46d1e228b7aa6d08bc8c273210009e23b70707ccbb9a

  • Size

    1.1MB

  • Sample

    241107-epz7gaxnfl

  • MD5

    355021505b5621ae11fc22b99e7ab815

  • SHA1

    e10083d354bab8099189c57f2909c542cbd70880

  • SHA256

    3bff47b7e9871173cacf46d1e228b7aa6d08bc8c273210009e23b70707ccbb9a

  • SHA512

    464342dc8a2685eef57d45e9128e9e682f08491a8a8121f121f78f948d1b5fd81fac63e01c20a7b7e092a8b1d86bda8b4d460fad24c77814c590fbb80e2330d4

  • SSDEEP

    24576:myDnZED4PH34z8vJpgV+zuPlbJK9kcl0ST4:1DPPXW8vJpgV+zCbJTcD

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      3bff47b7e9871173cacf46d1e228b7aa6d08bc8c273210009e23b70707ccbb9a

    • Size

      1.1MB

    • MD5

      355021505b5621ae11fc22b99e7ab815

    • SHA1

      e10083d354bab8099189c57f2909c542cbd70880

    • SHA256

      3bff47b7e9871173cacf46d1e228b7aa6d08bc8c273210009e23b70707ccbb9a

    • SHA512

      464342dc8a2685eef57d45e9128e9e682f08491a8a8121f121f78f948d1b5fd81fac63e01c20a7b7e092a8b1d86bda8b4d460fad24c77814c590fbb80e2330d4

    • SSDEEP

      24576:myDnZED4PH34z8vJpgV+zuPlbJK9kcl0ST4:1DPPXW8vJpgV+zCbJTcD

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks