General

  • Target

    0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b

  • Size

    468KB

  • Sample

    241108-2g23es1fnm

  • MD5

    9e161b1b079ca2f868f48275df796322

  • SHA1

    a7017d639e29d81598e8e23edcef01e0878a2995

  • SHA256

    0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b

  • SHA512

    003f5bd940a08182266a76816aa030e1fa46c6f7e7b7fa8ace855603bd33deb1da0e5e9098eb8a68e19e4c6fa6da0cec5a74e7cefbcb815ed13e22120f84f9ee

  • SSDEEP

    12288:2Mr/y90GZxeiAJDk7mKMTsNQeUnqtzXC:1yVeTJDk5MTsieKq4

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b

    • Size

      468KB

    • MD5

      9e161b1b079ca2f868f48275df796322

    • SHA1

      a7017d639e29d81598e8e23edcef01e0878a2995

    • SHA256

      0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b

    • SHA512

      003f5bd940a08182266a76816aa030e1fa46c6f7e7b7fa8ace855603bd33deb1da0e5e9098eb8a68e19e4c6fa6da0cec5a74e7cefbcb815ed13e22120f84f9ee

    • SSDEEP

      12288:2Mr/y90GZxeiAJDk7mKMTsNQeUnqtzXC:1yVeTJDk5MTsieKq4

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks