General

  • Target

    acb4b2770caf496876797b2181d9690f92e610d5513d57574cc83296ae06c10a

  • Size

    479KB

  • Sample

    241110-e93hbszdjk

  • MD5

    cac900fe7277a00749371af65a250edc

  • SHA1

    908e26c246d6760963dfdbe24f5e3f9d6120a4f8

  • SHA256

    acb4b2770caf496876797b2181d9690f92e610d5513d57574cc83296ae06c10a

  • SHA512

    9295b6f5d0240e42330cc64090c833fbfecc2c0896c3a3072588cd621b6922c84124e2613d40604571fdcdff83dfe394ae5e351ccf9770b7b40ce417c56b8d36

  • SSDEEP

    6144:KUy+bnr+ap0yN90QE7P9NCZ7EBGu2EVBllr/yvtB5CrEdpYDekUPbwpHBXG0Kr3a:AMruy90ZXu7EBj3lLyvzaASZhXD3F

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      acb4b2770caf496876797b2181d9690f92e610d5513d57574cc83296ae06c10a

    • Size

      479KB

    • MD5

      cac900fe7277a00749371af65a250edc

    • SHA1

      908e26c246d6760963dfdbe24f5e3f9d6120a4f8

    • SHA256

      acb4b2770caf496876797b2181d9690f92e610d5513d57574cc83296ae06c10a

    • SHA512

      9295b6f5d0240e42330cc64090c833fbfecc2c0896c3a3072588cd621b6922c84124e2613d40604571fdcdff83dfe394ae5e351ccf9770b7b40ce417c56b8d36

    • SSDEEP

      6144:KUy+bnr+ap0yN90QE7P9NCZ7EBGu2EVBllr/yvtB5CrEdpYDekUPbwpHBXG0Kr3a:AMruy90ZXu7EBj3lLyvzaASZhXD3F

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks