General

  • Target

    4a7e86c971caf008170de451f875b99a6b124dbb606acc82a223a1e31df92ab8

  • Size

    437KB

  • Sample

    241110-1z37rswhlc

  • MD5

    8ba50147a0d3befc1eda0e7a8ec6cb51

  • SHA1

    eee12bc723170a0413ea1f22323fe97e0ea035e0

  • SHA256

    4a7e86c971caf008170de451f875b99a6b124dbb606acc82a223a1e31df92ab8

  • SHA512

    057276758f3209fb20badd1a9edb6aff3876fd0c2eedb017723602ccaca23b0f3a66d47fc96adc8747643ceacec87801f025bc9c467542a18135759defcf30fd

  • SSDEEP

    12288:1Mrty907XcQk3o8HSfpzV+/Hu6Ky6GusYDU:wygmbSfpZ+/u6KVGusYDU

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes
  • auth_value

    f88f86755a528d4b25f6f3628c460965

Targets

    • Target

      4a7e86c971caf008170de451f875b99a6b124dbb606acc82a223a1e31df92ab8

    • Size

      437KB

    • MD5

      8ba50147a0d3befc1eda0e7a8ec6cb51

    • SHA1

      eee12bc723170a0413ea1f22323fe97e0ea035e0

    • SHA256

      4a7e86c971caf008170de451f875b99a6b124dbb606acc82a223a1e31df92ab8

    • SHA512

      057276758f3209fb20badd1a9edb6aff3876fd0c2eedb017723602ccaca23b0f3a66d47fc96adc8747643ceacec87801f025bc9c467542a18135759defcf30fd

    • SSDEEP

      12288:1Mrty907XcQk3o8HSfpzV+/Hu6Ky6GusYDU:wygmbSfpZ+/u6KVGusYDU

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks