General

  • Target

    b3535d9f303342a5160bdd9688a5dfc00a671e2cf88c4ff5721d320f7e758959

  • Size

    1.1MB

  • Sample

    241107-fmqexsykfj

  • MD5

    afa4e3786773ec9913638a5b9ed445a7

  • SHA1

    405cb9b9124298eb2dee4c238689da6302d960f9

  • SHA256

    b3535d9f303342a5160bdd9688a5dfc00a671e2cf88c4ff5721d320f7e758959

  • SHA512

    9cced99c40ed4cc01a2b5109ad2fb5471dc374f7683b771dcfc930a7ab2e58bffebab834505445ee541afce31e31b83f31ffb4f7c1e8938541d15da15be94344

  • SSDEEP

    24576:pyPF8cFjgb6lQw1o+/ynHKETUc9KIhTgP:cPF86gOQwK+gQcUITg

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      b3535d9f303342a5160bdd9688a5dfc00a671e2cf88c4ff5721d320f7e758959

    • Size

      1.1MB

    • MD5

      afa4e3786773ec9913638a5b9ed445a7

    • SHA1

      405cb9b9124298eb2dee4c238689da6302d960f9

    • SHA256

      b3535d9f303342a5160bdd9688a5dfc00a671e2cf88c4ff5721d320f7e758959

    • SHA512

      9cced99c40ed4cc01a2b5109ad2fb5471dc374f7683b771dcfc930a7ab2e58bffebab834505445ee541afce31e31b83f31ffb4f7c1e8938541d15da15be94344

    • SSDEEP

      24576:pyPF8cFjgb6lQw1o+/ynHKETUc9KIhTgP:cPF86gOQwK+gQcUITg

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks