General

  • Target

    71410e960c4988c58503e7d44b2e12082d4da41233a63a6c8fa2c3b1b0510f04.exe

  • Size

    371KB

  • Sample

    241110-2prawswncw

  • MD5

    364a74faeacebc4eadc5d6081289e388

  • SHA1

    1e73c1f760aad5aa650968980e607a2cb8cdd1bd

  • SHA256

    71410e960c4988c58503e7d44b2e12082d4da41233a63a6c8fa2c3b1b0510f04

  • SHA512

    488a6ff10f20ab48446517e0e89c5cbb08c18bf26209a329e3d86cb5030ac0db5d8672bd37a8a6dd2e1a4587509aafc17036d74afd4151ea36a2ba2f2a1206aa

  • SSDEEP

    6144:93p0yN90QESmKItMqxYr9rgFYeL6dEI2imkr72Aoyv+MB0le1tU/:My904SSE0rgCeLUy0oRsHtU/

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      71410e960c4988c58503e7d44b2e12082d4da41233a63a6c8fa2c3b1b0510f04.exe

    • Size

      371KB

    • MD5

      364a74faeacebc4eadc5d6081289e388

    • SHA1

      1e73c1f760aad5aa650968980e607a2cb8cdd1bd

    • SHA256

      71410e960c4988c58503e7d44b2e12082d4da41233a63a6c8fa2c3b1b0510f04

    • SHA512

      488a6ff10f20ab48446517e0e89c5cbb08c18bf26209a329e3d86cb5030ac0db5d8672bd37a8a6dd2e1a4587509aafc17036d74afd4151ea36a2ba2f2a1206aa

    • SSDEEP

      6144:93p0yN90QESmKItMqxYr9rgFYeL6dEI2imkr72Aoyv+MB0le1tU/:My904SSE0rgCeLUy0oRsHtU/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks