General

  • Target

    9fa974fa332c6d16fe09f3f68a42c4481069a2c11db91c00aa7b862621160088

  • Size

    550KB

  • Sample

    241109-wxv16azblh

  • MD5

    b34e6a747ee5ae617fadb1f9446bf48b

  • SHA1

    60a0c66a89ae3330910e32b5ac972f155095d61b

  • SHA256

    9fa974fa332c6d16fe09f3f68a42c4481069a2c11db91c00aa7b862621160088

  • SHA512

    df5637ac9c1641d36c065c4f523b27df541aa68d5fc6bf12168ae74e20d2170d84d520eccfa2aa1d850ec1e508c09e8a86208f2041567b7ae3a268787661cfb1

  • SSDEEP

    12288:9Mruy90z9Yn1VVCyqt1zLpsHNfZt6J90YxRGj1t:fyW90VY1zLkfZta90yGj1t

Malware Config

Extracted

Family

redline

Botnet

fusa

C2

193.233.20.12:4132

Attributes
  • auth_value

    a08b2f01bd2af756e38c5dd60e87e697

Targets

    • Target

      9fa974fa332c6d16fe09f3f68a42c4481069a2c11db91c00aa7b862621160088

    • Size

      550KB

    • MD5

      b34e6a747ee5ae617fadb1f9446bf48b

    • SHA1

      60a0c66a89ae3330910e32b5ac972f155095d61b

    • SHA256

      9fa974fa332c6d16fe09f3f68a42c4481069a2c11db91c00aa7b862621160088

    • SHA512

      df5637ac9c1641d36c065c4f523b27df541aa68d5fc6bf12168ae74e20d2170d84d520eccfa2aa1d850ec1e508c09e8a86208f2041567b7ae3a268787661cfb1

    • SSDEEP

      12288:9Mruy90z9Yn1VVCyqt1zLpsHNfZt6J90YxRGj1t:fyW90VY1zLkfZta90yGj1t

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks