General

  • Target

    aa2558c44012df8a2c19b159bcdc3dc14309feff7802cef346262ae2eadc3881

  • Size

    469KB

  • Sample

    241109-epekrsxdln

  • MD5

    7e3a8929fb0c34d0ed11a38ccd10822b

  • SHA1

    ec568317d4a34b0b423eff780f58b99f5173c199

  • SHA256

    aa2558c44012df8a2c19b159bcdc3dc14309feff7802cef346262ae2eadc3881

  • SHA512

    94170b4a877d7be2eef930da4bf6d38c8f489241c938e1a4636e3be29346c40d6d4b9c44d59f40eb8a7f490c5958225ea70c7212387d9c048f2061c54aedb762

  • SSDEEP

    12288:iMrby90qG1AVYYPNwu3+kzVa6WfTEakS:lyhJMu35zVa6rc

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      aa2558c44012df8a2c19b159bcdc3dc14309feff7802cef346262ae2eadc3881

    • Size

      469KB

    • MD5

      7e3a8929fb0c34d0ed11a38ccd10822b

    • SHA1

      ec568317d4a34b0b423eff780f58b99f5173c199

    • SHA256

      aa2558c44012df8a2c19b159bcdc3dc14309feff7802cef346262ae2eadc3881

    • SHA512

      94170b4a877d7be2eef930da4bf6d38c8f489241c938e1a4636e3be29346c40d6d4b9c44d59f40eb8a7f490c5958225ea70c7212387d9c048f2061c54aedb762

    • SSDEEP

      12288:iMrby90qG1AVYYPNwu3+kzVa6WfTEakS:lyhJMu35zVa6rc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks