General

  • Target

    1d0d37a223872281061bfb6f0800e09e483a9ce7ce6dbd608cbd53cfb99f92e9

  • Size

    480KB

  • Sample

    241110-1yx95awhkb

  • MD5

    fa61a9fc3bf89cbd1b762eb947d47fca

  • SHA1

    995dcef84dac96c2a5fb2ecc839f02e2cd91358a

  • SHA256

    1d0d37a223872281061bfb6f0800e09e483a9ce7ce6dbd608cbd53cfb99f92e9

  • SHA512

    2a5e70d17d1961c840476294633b7fc3408ded657954a66ec043c447250c7b01fd4b86b8f6210515599d4ec568042220454d926ae2d60ff352b0869d70b1ab82

  • SSDEEP

    12288:tMrmy90OZQDIGGifgDR7I6uFHKbT7Cbvx:ryevGifgDJQm7wx

Malware Config

Extracted

Family

redline

Botnet

daris

C2

217.196.96.56:4138

Attributes
  • auth_value

    3491f24ae0250969cd45ce4b3fe77549

Targets

    • Target

      1d0d37a223872281061bfb6f0800e09e483a9ce7ce6dbd608cbd53cfb99f92e9

    • Size

      480KB

    • MD5

      fa61a9fc3bf89cbd1b762eb947d47fca

    • SHA1

      995dcef84dac96c2a5fb2ecc839f02e2cd91358a

    • SHA256

      1d0d37a223872281061bfb6f0800e09e483a9ce7ce6dbd608cbd53cfb99f92e9

    • SHA512

      2a5e70d17d1961c840476294633b7fc3408ded657954a66ec043c447250c7b01fd4b86b8f6210515599d4ec568042220454d926ae2d60ff352b0869d70b1ab82

    • SSDEEP

      12288:tMrmy90OZQDIGGifgDR7I6uFHKbT7Cbvx:ryevGifgDJQm7wx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks