General

  • Target

    5793a81df0226b20c5df0aaf76728b50b56da46573369f98c6f4f5381ac1ce7b

  • Size

    469KB

  • Sample

    241109-heaqlszcrb

  • MD5

    d48a677ee3e89889b49cebf51f58cf9c

  • SHA1

    857cf36e761669d7b68f575898d9a4f59f367b29

  • SHA256

    5793a81df0226b20c5df0aaf76728b50b56da46573369f98c6f4f5381ac1ce7b

  • SHA512

    e68876a3e5bbc67d5cbc7548e1ce5d984d1fbe8d795dc8d622e65f510f4638fb48a4cda47afb0fa2edd191ab795cb290216609c3cd4021d9a7db68c4aae8c859

  • SSDEEP

    12288:GMrny90HaiTnytZ+tbQpDF+svqubSiWV4W+:tyE7A+ypDFdvqjiI+

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      5793a81df0226b20c5df0aaf76728b50b56da46573369f98c6f4f5381ac1ce7b

    • Size

      469KB

    • MD5

      d48a677ee3e89889b49cebf51f58cf9c

    • SHA1

      857cf36e761669d7b68f575898d9a4f59f367b29

    • SHA256

      5793a81df0226b20c5df0aaf76728b50b56da46573369f98c6f4f5381ac1ce7b

    • SHA512

      e68876a3e5bbc67d5cbc7548e1ce5d984d1fbe8d795dc8d622e65f510f4638fb48a4cda47afb0fa2edd191ab795cb290216609c3cd4021d9a7db68c4aae8c859

    • SSDEEP

      12288:GMrny90HaiTnytZ+tbQpDF+svqubSiWV4W+:tyE7A+ypDFdvqjiI+

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks