General

  • Target

    32356cb8c3457617573a8fd3d166eff5dc4a379d43171b8e92d86ea33cc42c94

  • Size

    1.5MB

  • Sample

    241110-1kbh7swdrd

  • MD5

    ecc1a1c330b4d00bc87ca7e665b3c994

  • SHA1

    8824454ec2b84a819e9922f4567f5ee417ad173f

  • SHA256

    32356cb8c3457617573a8fd3d166eff5dc4a379d43171b8e92d86ea33cc42c94

  • SHA512

    e3b866008310b792919c739639ebeaff3c66a1f32e80d97ace07a6a81348424a40f506edbe8ed5124a30575682cb4d986b8cb5ee7ac2a8a66256d6f8e9ef1918

  • SSDEEP

    24576:7yqRVcR4vmP8iFmRlEJevuQI02vrQM2CdaDQg84fbx74JZ3xJTNfLJ5+Ey0ezj3:uJnDwRlKe20C/4kg8PJJTNz2Pzj

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      32356cb8c3457617573a8fd3d166eff5dc4a379d43171b8e92d86ea33cc42c94

    • Size

      1.5MB

    • MD5

      ecc1a1c330b4d00bc87ca7e665b3c994

    • SHA1

      8824454ec2b84a819e9922f4567f5ee417ad173f

    • SHA256

      32356cb8c3457617573a8fd3d166eff5dc4a379d43171b8e92d86ea33cc42c94

    • SHA512

      e3b866008310b792919c739639ebeaff3c66a1f32e80d97ace07a6a81348424a40f506edbe8ed5124a30575682cb4d986b8cb5ee7ac2a8a66256d6f8e9ef1918

    • SSDEEP

      24576:7yqRVcR4vmP8iFmRlEJevuQI02vrQM2CdaDQg84fbx74JZ3xJTNfLJ5+Ey0ezj3:uJnDwRlKe20C/4kg8PJJTNz2Pzj

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks