General

  • Target

    b03fe062bedc423b43befb7f91acd6ffb0f65ff0358d7d8e212d45c8581a71ce

  • Size

    583KB

  • Sample

    241110-b1jr3swkdy

  • MD5

    280649030aadf2dfb20a8601e5e2fab5

  • SHA1

    22111d6f81d55ddafadf406c219bcea4985b4f04

  • SHA256

    b03fe062bedc423b43befb7f91acd6ffb0f65ff0358d7d8e212d45c8581a71ce

  • SHA512

    3937db3438933a6c61fd6db28071bb1207f0a10dcb693250d9cb0443c1d943c5b90a339cb1c6cbd866e8552e46066a168586b767f91c0366830a539648ebafa9

  • SSDEEP

    12288:RMrMy9090VFKoMqbmcPmkLwhD5qBWDmA1ue0:1yTVfjbpYD5BmGr0

Malware Config

Extracted

Family

redline

Botnet

ronam

C2

193.233.20.17:4139

Attributes
  • auth_value

    125421d19d14dd7fd211bc7f6d4aea6c

Targets

    • Target

      b03fe062bedc423b43befb7f91acd6ffb0f65ff0358d7d8e212d45c8581a71ce

    • Size

      583KB

    • MD5

      280649030aadf2dfb20a8601e5e2fab5

    • SHA1

      22111d6f81d55ddafadf406c219bcea4985b4f04

    • SHA256

      b03fe062bedc423b43befb7f91acd6ffb0f65ff0358d7d8e212d45c8581a71ce

    • SHA512

      3937db3438933a6c61fd6db28071bb1207f0a10dcb693250d9cb0443c1d943c5b90a339cb1c6cbd866e8552e46066a168586b767f91c0366830a539648ebafa9

    • SSDEEP

      12288:RMrMy9090VFKoMqbmcPmkLwhD5qBWDmA1ue0:1yTVfjbpYD5BmGr0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks