General

  • Target

    b5bcc68a70d3e77be27c9abdb79de431472fd1ede8076834c31c5565e8c1810b

  • Size

    479KB

  • Sample

    241110-3qy8ka1jfr

  • MD5

    e0912697f059362e06deedb00570b13a

  • SHA1

    a3e4bced506af5ae6e12443489edc9ebb6cf6fba

  • SHA256

    b5bcc68a70d3e77be27c9abdb79de431472fd1ede8076834c31c5565e8c1810b

  • SHA512

    22cc7786033597daa0a6cbbfb15cf9f6a828a5b86c5ddb09079b88b548463f09a18e6be03deaf620a9aaa171ef33a321f51892eaed385e2f40ec343a8973a5d3

  • SSDEEP

    12288:9MrQy900/Dkpgh928ZmfNnKN7JZyzlj252i:1yhkpodm1AZul65Z

Malware Config

Extracted

Family

redline

Botnet

domor

C2

217.196.96.101:4132

Attributes
  • auth_value

    39471bda00546bb0435bc7adfd6881dc

Targets

    • Target

      b5bcc68a70d3e77be27c9abdb79de431472fd1ede8076834c31c5565e8c1810b

    • Size

      479KB

    • MD5

      e0912697f059362e06deedb00570b13a

    • SHA1

      a3e4bced506af5ae6e12443489edc9ebb6cf6fba

    • SHA256

      b5bcc68a70d3e77be27c9abdb79de431472fd1ede8076834c31c5565e8c1810b

    • SHA512

      22cc7786033597daa0a6cbbfb15cf9f6a828a5b86c5ddb09079b88b548463f09a18e6be03deaf620a9aaa171ef33a321f51892eaed385e2f40ec343a8973a5d3

    • SSDEEP

      12288:9MrQy900/Dkpgh928ZmfNnKN7JZyzlj252i:1yhkpodm1AZul65Z

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks