General

  • Target

    f36c03b4a2e391d03b742a8e36e3b097b6df0c0368df8542133d8f924bb6234c

  • Size

    556KB

  • Sample

    241109-m1n8cawkhj

  • MD5

    4a438861b68572a57174e7cc421513bc

  • SHA1

    a752174a3c7ee445a3f87cadd13e2b9190ef1470

  • SHA256

    f36c03b4a2e391d03b742a8e36e3b097b6df0c0368df8542133d8f924bb6234c

  • SHA512

    86e388a9e3af6e597f48ecb05bd125efd20f00470f518afa2270a63de961d651dc94f9f5cfb347f909e51ab4dccc317c3ae12ebb365adc4a486ec24b5a134a25

  • SSDEEP

    12288:+MrKy90wlODTdRK1u2YfzXe8gh/n+TQR7U5xYP1LqIJ8hXJho:oyflOtrHfzuPhjq5x+pq3dbo

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Targets

    • Target

      f36c03b4a2e391d03b742a8e36e3b097b6df0c0368df8542133d8f924bb6234c

    • Size

      556KB

    • MD5

      4a438861b68572a57174e7cc421513bc

    • SHA1

      a752174a3c7ee445a3f87cadd13e2b9190ef1470

    • SHA256

      f36c03b4a2e391d03b742a8e36e3b097b6df0c0368df8542133d8f924bb6234c

    • SHA512

      86e388a9e3af6e597f48ecb05bd125efd20f00470f518afa2270a63de961d651dc94f9f5cfb347f909e51ab4dccc317c3ae12ebb365adc4a486ec24b5a134a25

    • SSDEEP

      12288:+MrKy90wlODTdRK1u2YfzXe8gh/n+TQR7U5xYP1LqIJ8hXJho:oyflOtrHfzuPhjq5x+pq3dbo

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks