General

  • Target

    ee679b68f0b712d16db529947ae5ef1445b48e86bfaba548b7398faa2478ae6b

  • Size

    479KB

  • Sample

    241109-vebdcsybmf

  • MD5

    b683bedb355a0a63320f276dbb3a6d7b

  • SHA1

    4ed5bd12c277548446d067646d9aec6e3714032d

  • SHA256

    ee679b68f0b712d16db529947ae5ef1445b48e86bfaba548b7398faa2478ae6b

  • SHA512

    a2c444abea3d0fb2476409c41d535b632cb991f08d81aca702493067a79766e7496dc5266c9e2e0e569f376ba2ab1510f1872f160d38d3fd8ddcbd1bd940b4e8

  • SSDEEP

    12288:mMrSy90T0BAbPSjAX7z77XplsDZQ4IDrr:wyy5bqy77ZhDn

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      ee679b68f0b712d16db529947ae5ef1445b48e86bfaba548b7398faa2478ae6b

    • Size

      479KB

    • MD5

      b683bedb355a0a63320f276dbb3a6d7b

    • SHA1

      4ed5bd12c277548446d067646d9aec6e3714032d

    • SHA256

      ee679b68f0b712d16db529947ae5ef1445b48e86bfaba548b7398faa2478ae6b

    • SHA512

      a2c444abea3d0fb2476409c41d535b632cb991f08d81aca702493067a79766e7496dc5266c9e2e0e569f376ba2ab1510f1872f160d38d3fd8ddcbd1bd940b4e8

    • SSDEEP

      12288:mMrSy90T0BAbPSjAX7z77XplsDZQ4IDrr:wyy5bqy77ZhDn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks