General

  • Target

    0c96991c63cf0ce1bdbcda6ee11406e90de40493a0f8c5873c2428b7d607bb2e

  • Size

    550KB

  • Sample

    241109-3eckesxldr

  • MD5

    d79569dc816df8b41cbf75292ce581e4

  • SHA1

    cd0c4aee158293aa482a548a7b8286fc7d16458c

  • SHA256

    0c96991c63cf0ce1bdbcda6ee11406e90de40493a0f8c5873c2428b7d607bb2e

  • SHA512

    f5b60ecfad1351428c1b9e7ddeac0fc67277def7b14f0a0b45fbf6792a19af9644a2ac8d0a79c321abe6d642f286963f46561f031c91110fe0f6da14cda6bb4b

  • SSDEEP

    12288:bMrgy90DmsxFmzNXm3i9mgZRjPrVkVYA0gB7Cp7iMDN:zyeV+W3iJdjTYAdhDN

Malware Config

Extracted

Family

redline

Botnet

fusa

C2

193.233.20.12:4132

Attributes
  • auth_value

    a08b2f01bd2af756e38c5dd60e87e697

Targets

    • Target

      0c96991c63cf0ce1bdbcda6ee11406e90de40493a0f8c5873c2428b7d607bb2e

    • Size

      550KB

    • MD5

      d79569dc816df8b41cbf75292ce581e4

    • SHA1

      cd0c4aee158293aa482a548a7b8286fc7d16458c

    • SHA256

      0c96991c63cf0ce1bdbcda6ee11406e90de40493a0f8c5873c2428b7d607bb2e

    • SHA512

      f5b60ecfad1351428c1b9e7ddeac0fc67277def7b14f0a0b45fbf6792a19af9644a2ac8d0a79c321abe6d642f286963f46561f031c91110fe0f6da14cda6bb4b

    • SSDEEP

      12288:bMrgy90DmsxFmzNXm3i9mgZRjPrVkVYA0gB7Cp7iMDN:zyeV+W3iJdjTYAdhDN

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks