General

  • Target

    70493cc9f2caad0674535f34f16f57e2c6f6f4dfddf3bb6d9de787cd1c5ac77d

  • Size

    1.1MB

  • Sample

    241108-rgel1stelq

  • MD5

    4a53e0af4d885dfb527ba07dfbb1c2a9

  • SHA1

    93d5ec59738a319f932aed3770ed279538367221

  • SHA256

    70493cc9f2caad0674535f34f16f57e2c6f6f4dfddf3bb6d9de787cd1c5ac77d

  • SHA512

    31585d7351b3287f1a78e469151644d29fbb3cfa7b73e55e7225eeaef7efa4377a9915949c67defe7ea3fba71494c15a1ef25041a30b0ed93bae3a3bcb45bb65

  • SSDEEP

    24576:HyPuHwG+j0f59AMNeCaWhmYHWrgd0fl1XUZOdyP+u4K8:SPuHQj0B9AMaS52CkbkZ71D

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      70493cc9f2caad0674535f34f16f57e2c6f6f4dfddf3bb6d9de787cd1c5ac77d

    • Size

      1.1MB

    • MD5

      4a53e0af4d885dfb527ba07dfbb1c2a9

    • SHA1

      93d5ec59738a319f932aed3770ed279538367221

    • SHA256

      70493cc9f2caad0674535f34f16f57e2c6f6f4dfddf3bb6d9de787cd1c5ac77d

    • SHA512

      31585d7351b3287f1a78e469151644d29fbb3cfa7b73e55e7225eeaef7efa4377a9915949c67defe7ea3fba71494c15a1ef25041a30b0ed93bae3a3bcb45bb65

    • SSDEEP

      24576:HyPuHwG+j0f59AMNeCaWhmYHWrgd0fl1XUZOdyP+u4K8:SPuHQj0B9AMaS52CkbkZ71D

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks