General

  • Target

    c8f8c0efe800b958dde5b4d7d499ce9c34892d14c8b35a832cde781b569b3981

  • Size

    479KB

  • Sample

    241109-s36haswmfx

  • MD5

    79aa93dc2b10822228cecdfece3a20be

  • SHA1

    b328d3c963173688b3c3ee99efc6644a5dc72106

  • SHA256

    c8f8c0efe800b958dde5b4d7d499ce9c34892d14c8b35a832cde781b569b3981

  • SHA512

    35117f6f84f02cb8fb8449670749fe1bc4621c53483f55a0e6e09089310c8089e6124cb8ea1438907e0dc84c3a8ff3669285e46236dcca7e74592471a8b575a9

  • SSDEEP

    12288:eMrry90jkNJb+dIWqL7v+VwvnSLhlWpEdEsrMiF+iG:pyRcdhlWpEvy

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      c8f8c0efe800b958dde5b4d7d499ce9c34892d14c8b35a832cde781b569b3981

    • Size

      479KB

    • MD5

      79aa93dc2b10822228cecdfece3a20be

    • SHA1

      b328d3c963173688b3c3ee99efc6644a5dc72106

    • SHA256

      c8f8c0efe800b958dde5b4d7d499ce9c34892d14c8b35a832cde781b569b3981

    • SHA512

      35117f6f84f02cb8fb8449670749fe1bc4621c53483f55a0e6e09089310c8089e6124cb8ea1438907e0dc84c3a8ff3669285e46236dcca7e74592471a8b575a9

    • SSDEEP

      12288:eMrry90jkNJb+dIWqL7v+VwvnSLhlWpEdEsrMiF+iG:pyRcdhlWpEvy

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks