General

  • Target

    ba57b739fe3cc2d6e783bf0b2965758a30896c15cb65be9c1bed45ec12040cf0

  • Size

    425KB

  • Sample

    241108-zgb5wssjbr

  • MD5

    7daa57277d5dba056f3ee8010792ce7d

  • SHA1

    e2eb2e5435a1dbf70627a1120c7c3621138e0ee8

  • SHA256

    ba57b739fe3cc2d6e783bf0b2965758a30896c15cb65be9c1bed45ec12040cf0

  • SHA512

    f1c588259e2518f117376402c02da1667cf98b3995874bfddcc14499e4933a3598c6dd8f75371c2ec7ff430429ca89ba701adfcb5819ae965b6b0f77b542310b

  • SSDEEP

    12288:wuUyFbYDQ4YZb9lfh3pUbsagVYmqYJjM0W:BFkQDbPfrRagVYmqYpQ

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      a73a1a0b55c18085c146c9b1fcbfb5e8e722302a97b7b1d33c37ed9a15d6e991.exe

    • Size

      476KB

    • MD5

      ad56c0e70f2b868addd76490608fee5d

    • SHA1

      2003b329f24a539d89211866c8000a7098f3852c

    • SHA256

      a73a1a0b55c18085c146c9b1fcbfb5e8e722302a97b7b1d33c37ed9a15d6e991

    • SHA512

      ad0ae6be00bd245e305b23221346e5249f0457bb5a6290d26740fd9297ba405f2ae128eaca1ae1f0175e408f1c6af64c307b76bd21b03c2f04c8f1898ce0f727

    • SSDEEP

      6144:KYy+bnr+hp0yN90QErFPP6Cxfr8LnBD1Za4+Opbv1m4PaEUjsiJ18Dv4Th7+eFcN:MMrVy90JFqHbBTaLqvLBU3IAd1CN

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks