General

  • Target

    e3a315406a1e36ee63cc1953f99e6306c1fac8f66a7063d5e0672d56e97e6914

  • Size

    632KB

  • Sample

    241110-3k4abswrht

  • MD5

    11579075813469d9df2db396cf92f1de

  • SHA1

    a8ceaafee8287239d20adc1039811a2a2184adf1

  • SHA256

    e3a315406a1e36ee63cc1953f99e6306c1fac8f66a7063d5e0672d56e97e6914

  • SHA512

    4ef1f905ad9d5f7d7d5325fbd74fb29c8cb03025046537cb1d090406181d7128e0bb0aafa3f9d625c30dcd9e076a62ea86445d9e4202cd92a0ce429039816b7c

  • SSDEEP

    12288:/MrWy90mCKMsTM5vJl0CK5ZiEl6WnfB41vMIUDi:5y3CKMj6dmGp4WIUDi

Malware Config

Extracted

Family

redline

Botnet

bilod

C2

193.233.20.7:4138

Attributes
  • auth_value

    407a8c8d5a1f9a3348afc8c6b0155512

Targets

    • Target

      e3a315406a1e36ee63cc1953f99e6306c1fac8f66a7063d5e0672d56e97e6914

    • Size

      632KB

    • MD5

      11579075813469d9df2db396cf92f1de

    • SHA1

      a8ceaafee8287239d20adc1039811a2a2184adf1

    • SHA256

      e3a315406a1e36ee63cc1953f99e6306c1fac8f66a7063d5e0672d56e97e6914

    • SHA512

      4ef1f905ad9d5f7d7d5325fbd74fb29c8cb03025046537cb1d090406181d7128e0bb0aafa3f9d625c30dcd9e076a62ea86445d9e4202cd92a0ce429039816b7c

    • SSDEEP

      12288:/MrWy90mCKMsTM5vJl0CK5ZiEl6WnfB41vMIUDi:5y3CKMj6dmGp4WIUDi

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks