General

  • Target

    13ed2817827b7f56956004f44c8780d6234bf880e717305cdf635fc4a7fee4d3

  • Size

    843KB

  • Sample

    241109-ymhdeszngs

  • MD5

    b62ede9e22de498feb272b7631d133a2

  • SHA1

    8aab2fd5253628e47aa1aef22e9f5d1d54a49a8f

  • SHA256

    13ed2817827b7f56956004f44c8780d6234bf880e717305cdf635fc4a7fee4d3

  • SHA512

    610a5d22e7783751048cca792b71e91b266e9eff063963c99b6cf071d675d55f619a069093c10860ca0f23464c4dbb312f6bd7f4bc3cf8ca2d744c2a28fb21ed

  • SSDEEP

    24576:EyNaV1+NxXm3dlyNfxDKbS9/ocwi9fAUfe:TNe+bXmHwfY4gJiAa

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      13ed2817827b7f56956004f44c8780d6234bf880e717305cdf635fc4a7fee4d3

    • Size

      843KB

    • MD5

      b62ede9e22de498feb272b7631d133a2

    • SHA1

      8aab2fd5253628e47aa1aef22e9f5d1d54a49a8f

    • SHA256

      13ed2817827b7f56956004f44c8780d6234bf880e717305cdf635fc4a7fee4d3

    • SHA512

      610a5d22e7783751048cca792b71e91b266e9eff063963c99b6cf071d675d55f619a069093c10860ca0f23464c4dbb312f6bd7f4bc3cf8ca2d744c2a28fb21ed

    • SSDEEP

      24576:EyNaV1+NxXm3dlyNfxDKbS9/ocwi9fAUfe:TNe+bXmHwfY4gJiAa

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks