General

  • Target

    eacf0af8672b2a217688adc05d9a6dd3ffc4045f01709430ea008b715c6397ad

  • Size

    582KB

  • Sample

    241109-x8xjsstlan

  • MD5

    a6a763390cdabd619964059754132bb3

  • SHA1

    123a40afc54a9a231a9a933a7c35e33ca776a409

  • SHA256

    eacf0af8672b2a217688adc05d9a6dd3ffc4045f01709430ea008b715c6397ad

  • SHA512

    1149052c67280720210813913fcd9b5cd9072fe104287ca0fa3f35610d185bc80955b0a9f96b783e69954e381dbf9898b434870843a7ffff2f742ec32227c80f

  • SSDEEP

    12288:OMriy90e14rawQJxnbFch9RJdzCiQ0+XtP/gigQIMCcEwjpqYsD:0y51ZwQXb2hjmpPXmiggjLE

Malware Config

Extracted

Family

redline

Botnet

ronam

C2

193.233.20.17:4139

Attributes
  • auth_value

    125421d19d14dd7fd211bc7f6d4aea6c

Targets

    • Target

      eacf0af8672b2a217688adc05d9a6dd3ffc4045f01709430ea008b715c6397ad

    • Size

      582KB

    • MD5

      a6a763390cdabd619964059754132bb3

    • SHA1

      123a40afc54a9a231a9a933a7c35e33ca776a409

    • SHA256

      eacf0af8672b2a217688adc05d9a6dd3ffc4045f01709430ea008b715c6397ad

    • SHA512

      1149052c67280720210813913fcd9b5cd9072fe104287ca0fa3f35610d185bc80955b0a9f96b783e69954e381dbf9898b434870843a7ffff2f742ec32227c80f

    • SSDEEP

      12288:OMriy90e14rawQJxnbFch9RJdzCiQ0+XtP/gigQIMCcEwjpqYsD:0y51ZwQXb2hjmpPXmiggjLE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks