General

  • Target

    d76845d47e2e1eed387503f243202bfa763c20788eb155801662b963d24a3c2a

  • Size

    468KB

  • Sample

    241109-e4fflsxjbz

  • MD5

    158ff10c88f7156c9a9fb25d02f4dd9d

  • SHA1

    d2a91c348d190b7050c1825e7c2d5a304f3c4980

  • SHA256

    d76845d47e2e1eed387503f243202bfa763c20788eb155801662b963d24a3c2a

  • SHA512

    66d41faad780677a475e292f6ad6b2366fe711c7bb817a3e3d0e6c940b5beca804f449f7834cfec247838bad6081cf53ab1c790bc55894cf53a767ced90e3bdb

  • SSDEEP

    12288:vMrDy90xkWV342Fm0utIOv4JDXznqtEPvtP:4yIV/gh4VLq+PF

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      d76845d47e2e1eed387503f243202bfa763c20788eb155801662b963d24a3c2a

    • Size

      468KB

    • MD5

      158ff10c88f7156c9a9fb25d02f4dd9d

    • SHA1

      d2a91c348d190b7050c1825e7c2d5a304f3c4980

    • SHA256

      d76845d47e2e1eed387503f243202bfa763c20788eb155801662b963d24a3c2a

    • SHA512

      66d41faad780677a475e292f6ad6b2366fe711c7bb817a3e3d0e6c940b5beca804f449f7834cfec247838bad6081cf53ab1c790bc55894cf53a767ced90e3bdb

    • SSDEEP

      12288:vMrDy90xkWV342Fm0utIOv4JDXznqtEPvtP:4yIV/gh4VLq+PF

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks