General

  • Target

    9b9fbe39d9cbbe1660b5ec01fb01a32e5913502def2fdec4162c22a3737a76cb

  • Size

    1.1MB

  • Sample

    241110-13sv7szkbl

  • MD5

    dc93f4cedfa49f3595bf2d04433f955d

  • SHA1

    25d5f1e932daf3cc31c436dcb68dc81e3482be78

  • SHA256

    9b9fbe39d9cbbe1660b5ec01fb01a32e5913502def2fdec4162c22a3737a76cb

  • SHA512

    c88a379d1a32c6ff53832b5c608d23177494d21208fb7b211f189c57d234c01734db772e9344bc7b8e684ce59fb19d7a9ac20e003c9f712780b4a3232d8b7fc9

  • SSDEEP

    24576:TyGL2Xu2d+XnA1WBinl0WzjM4JD+jawsloaLmDI:mGL2Xn6A1WglHJDsVsl/LE

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      9b9fbe39d9cbbe1660b5ec01fb01a32e5913502def2fdec4162c22a3737a76cb

    • Size

      1.1MB

    • MD5

      dc93f4cedfa49f3595bf2d04433f955d

    • SHA1

      25d5f1e932daf3cc31c436dcb68dc81e3482be78

    • SHA256

      9b9fbe39d9cbbe1660b5ec01fb01a32e5913502def2fdec4162c22a3737a76cb

    • SHA512

      c88a379d1a32c6ff53832b5c608d23177494d21208fb7b211f189c57d234c01734db772e9344bc7b8e684ce59fb19d7a9ac20e003c9f712780b4a3232d8b7fc9

    • SSDEEP

      24576:TyGL2Xu2d+XnA1WBinl0WzjM4JD+jawsloaLmDI:mGL2Xn6A1WglHJDsVsl/LE

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks