General

  • Target

    3ccaca92651390a6c99db1508b0f075c2c5bbf8dced22c0d497ce3bd8a47461c

  • Size

    1.1MB

  • Sample

    241107-g351zsxflq

  • MD5

    445bf77b4f176b689796b4d798678c97

  • SHA1

    69d2c5a2d84f4c90c4505ba69937fa1fbffae5d3

  • SHA256

    3ccaca92651390a6c99db1508b0f075c2c5bbf8dced22c0d497ce3bd8a47461c

  • SHA512

    f743a49eef955f26054cc52de4096f7b9759358b328154f24457cd62ef6209a76724a5f3d10c83e42e5a1c295db3c7ffeacb60da77e00bbbb2ca8c1031d9da36

  • SSDEEP

    24576:syCM482Kx9VkVhBnquemoToH5mfJzsCOCeqkHVw:bCPKFKh5cToH5N

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      3ccaca92651390a6c99db1508b0f075c2c5bbf8dced22c0d497ce3bd8a47461c

    • Size

      1.1MB

    • MD5

      445bf77b4f176b689796b4d798678c97

    • SHA1

      69d2c5a2d84f4c90c4505ba69937fa1fbffae5d3

    • SHA256

      3ccaca92651390a6c99db1508b0f075c2c5bbf8dced22c0d497ce3bd8a47461c

    • SHA512

      f743a49eef955f26054cc52de4096f7b9759358b328154f24457cd62ef6209a76724a5f3d10c83e42e5a1c295db3c7ffeacb60da77e00bbbb2ca8c1031d9da36

    • SSDEEP

      24576:syCM482Kx9VkVhBnquemoToH5mfJzsCOCeqkHVw:bCPKFKh5cToH5N

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks