General

  • Target

    7bf35066ed70e912bdfc9da8ff774f2f6ab2983455ee7dd7d253fecdbea06cc6

  • Size

    479KB

  • Sample

    241110-3ladmsxdrl

  • MD5

    70934e9b29ce70f1851cdb9d97d80710

  • SHA1

    4ca2dbce789303c60d3c821e82df2ef34a19ede8

  • SHA256

    7bf35066ed70e912bdfc9da8ff774f2f6ab2983455ee7dd7d253fecdbea06cc6

  • SHA512

    1b7b361a7da5bf4bf06042b292e5c453e92182070b49fef58a5732a17cfb171a1dbaac62f87a7b534ec3ab2281dfebaecea0794343c5a20b3400fc583b07ec85

  • SSDEEP

    12288:gMriy90dXAWlnScWSAGEKAwnB6wpP8ovogZ6STblGyr:SyVWlFgWBBp0KJblXr

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      7bf35066ed70e912bdfc9da8ff774f2f6ab2983455ee7dd7d253fecdbea06cc6

    • Size

      479KB

    • MD5

      70934e9b29ce70f1851cdb9d97d80710

    • SHA1

      4ca2dbce789303c60d3c821e82df2ef34a19ede8

    • SHA256

      7bf35066ed70e912bdfc9da8ff774f2f6ab2983455ee7dd7d253fecdbea06cc6

    • SHA512

      1b7b361a7da5bf4bf06042b292e5c453e92182070b49fef58a5732a17cfb171a1dbaac62f87a7b534ec3ab2281dfebaecea0794343c5a20b3400fc583b07ec85

    • SSDEEP

      12288:gMriy90dXAWlnScWSAGEKAwnB6wpP8ovogZ6STblGyr:SyVWlFgWBBp0KJblXr

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks