General

  • Target

    43664bf9069cafb08fa1646dfc82f2f15649c5e4a3571ab84b5d73fe96c8c852

  • Size

    772KB

  • Sample

    241109-xpmv9azfkd

  • MD5

    ab6f2bdf49335375e2329e6c5354bc9d

  • SHA1

    4d9e8b2412ca2472ae871657d4e59800147f0de7

  • SHA256

    43664bf9069cafb08fa1646dfc82f2f15649c5e4a3571ab84b5d73fe96c8c852

  • SHA512

    dcfdcbd2ea5d03daa51137658df878e056b217268ab6410c1f9485b90b9b9715f51c6968ba575efbf3d45c884d6580b6f10d075c8bf1b4a8a655466406cc2115

  • SSDEEP

    24576:gywwFqN4vbt4aiUZ/5tznKoxTzUGZ8I+8y+xWrY:nwwgSjqc5zlFB+8yJ

Malware Config

Extracted

Family

redline

Botnet

dubur

C2

217.196.96.102:4132

Attributes
  • auth_value

    32d04179aa1e8d655d2d80c21f99de41

Targets

    • Target

      43664bf9069cafb08fa1646dfc82f2f15649c5e4a3571ab84b5d73fe96c8c852

    • Size

      772KB

    • MD5

      ab6f2bdf49335375e2329e6c5354bc9d

    • SHA1

      4d9e8b2412ca2472ae871657d4e59800147f0de7

    • SHA256

      43664bf9069cafb08fa1646dfc82f2f15649c5e4a3571ab84b5d73fe96c8c852

    • SHA512

      dcfdcbd2ea5d03daa51137658df878e056b217268ab6410c1f9485b90b9b9715f51c6968ba575efbf3d45c884d6580b6f10d075c8bf1b4a8a655466406cc2115

    • SSDEEP

      24576:gywwFqN4vbt4aiUZ/5tznKoxTzUGZ8I+8y+xWrY:nwwgSjqc5zlFB+8yJ

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks