General

  • Target

    31b917eba13e16b79eaa40a15fef6f0d462860885bb756da9e3078693686036d

  • Size

    479KB

  • Sample

    241109-crgf2avfqq

  • MD5

    3aa8dd4de403d2a5f90beca6e9d1f657

  • SHA1

    d9838915118a4909825968c8aa1c99d4e819b831

  • SHA256

    31b917eba13e16b79eaa40a15fef6f0d462860885bb756da9e3078693686036d

  • SHA512

    cd5f04f3b980544eb6678d0185d1b87ee849ad134462ead0c5254516f3264a3ea1a8ca0988a56eeb00371410b895d48b79ab16f84354cf9aa153a83c65250b79

  • SSDEEP

    12288:lMr4y90knkSt/+dVf6q7QVBotq7UM5G9:NytnkI+DfFYBxY+G9

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      31b917eba13e16b79eaa40a15fef6f0d462860885bb756da9e3078693686036d

    • Size

      479KB

    • MD5

      3aa8dd4de403d2a5f90beca6e9d1f657

    • SHA1

      d9838915118a4909825968c8aa1c99d4e819b831

    • SHA256

      31b917eba13e16b79eaa40a15fef6f0d462860885bb756da9e3078693686036d

    • SHA512

      cd5f04f3b980544eb6678d0185d1b87ee849ad134462ead0c5254516f3264a3ea1a8ca0988a56eeb00371410b895d48b79ab16f84354cf9aa153a83c65250b79

    • SSDEEP

      12288:lMr4y90knkSt/+dVf6q7QVBotq7UM5G9:NytnkI+DfFYBxY+G9

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks