General

  • Target

    8b5a064f118a278b7427481d39533826cfe81e431268f6cb5c201454961a7783

  • Size

    584KB

  • Sample

    241109-mdtjjssfnd

  • MD5

    8902702fd0d20c1988f317b447c6d3f7

  • SHA1

    d98a6ab787f5c3313f2774f102e39b41e3db450b

  • SHA256

    8b5a064f118a278b7427481d39533826cfe81e431268f6cb5c201454961a7783

  • SHA512

    67b565a41b6169edf0594febe72b2263bb56fa32cab3a3cfa5ae60fee6b836f7b7e581c387e2afbcebe4e0dba3917b45dcfac76bf64322de2174d3e20be06743

  • SSDEEP

    12288:KMrVy90cQbiDQx1KIaarw7cxowMjB+fGQpIuSbvUjGg98v5REfp+:Lyp2daarw7a5MUnHSbe8RREfp+

Malware Config

Extracted

Family

redline

Botnet

ronam

C2

193.233.20.17:4139

Attributes
  • auth_value

    125421d19d14dd7fd211bc7f6d4aea6c

Targets

    • Target

      8b5a064f118a278b7427481d39533826cfe81e431268f6cb5c201454961a7783

    • Size

      584KB

    • MD5

      8902702fd0d20c1988f317b447c6d3f7

    • SHA1

      d98a6ab787f5c3313f2774f102e39b41e3db450b

    • SHA256

      8b5a064f118a278b7427481d39533826cfe81e431268f6cb5c201454961a7783

    • SHA512

      67b565a41b6169edf0594febe72b2263bb56fa32cab3a3cfa5ae60fee6b836f7b7e581c387e2afbcebe4e0dba3917b45dcfac76bf64322de2174d3e20be06743

    • SSDEEP

      12288:KMrVy90cQbiDQx1KIaarw7cxowMjB+fGQpIuSbvUjGg98v5REfp+:Lyp2daarw7a5MUnHSbe8RREfp+

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks