General

  • Target

    29e07164d93570d3b8bd5fb73893ca9bd6a930d5623339514bc3652694566ce4

  • Size

    480KB

  • Sample

    241110-1h9m8avpbw

  • MD5

    5f3c414d151f26f4ec7b024158b837ec

  • SHA1

    9e86ef1013584b8e8040018fc3530bd0e722781e

  • SHA256

    29e07164d93570d3b8bd5fb73893ca9bd6a930d5623339514bc3652694566ce4

  • SHA512

    57a22bdf9d00db57b8b9394be836d564a10addf7c4deac188881838aa60cded8507d6fd53e1bffbb69a754632be11dd6da7fe7949ef13bb76452b75ba2f1c8d1

  • SSDEEP

    12288:MMr3y90LGjmd4fMgeBD4jDuP53UI487eHXa/c:zynjmd4fMlLPRfKHXa/c

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      29e07164d93570d3b8bd5fb73893ca9bd6a930d5623339514bc3652694566ce4

    • Size

      480KB

    • MD5

      5f3c414d151f26f4ec7b024158b837ec

    • SHA1

      9e86ef1013584b8e8040018fc3530bd0e722781e

    • SHA256

      29e07164d93570d3b8bd5fb73893ca9bd6a930d5623339514bc3652694566ce4

    • SHA512

      57a22bdf9d00db57b8b9394be836d564a10addf7c4deac188881838aa60cded8507d6fd53e1bffbb69a754632be11dd6da7fe7949ef13bb76452b75ba2f1c8d1

    • SSDEEP

      12288:MMr3y90LGjmd4fMgeBD4jDuP53UI487eHXa/c:zynjmd4fMlLPRfKHXa/c

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks