General

  • Target

    8669409e56243e4b34c5418783f9b4c0ee6719214fbcc4296f451f51f687beaa

  • Size

    477KB

  • Sample

    241110-flgrdszkds

  • MD5

    02d5535399df8ab9d5235607ced407fe

  • SHA1

    bc90681d7b4101f18b1263f5227a1172cbd3293e

  • SHA256

    8669409e56243e4b34c5418783f9b4c0ee6719214fbcc4296f451f51f687beaa

  • SHA512

    a003924438ad839eedecdfc3e8feb5fce0900344298353f8d39ad42818526780adda352fa27926fb3a3b868bf6f4bb384b4740cfd7bcf9eda1f10cc3e6ff58f5

  • SSDEEP

    12288:zMrsy905Jw/QVDEJedgAQLcdSx1ka8ORHKB:DyidVgeWAQLjMORqB

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      8669409e56243e4b34c5418783f9b4c0ee6719214fbcc4296f451f51f687beaa

    • Size

      477KB

    • MD5

      02d5535399df8ab9d5235607ced407fe

    • SHA1

      bc90681d7b4101f18b1263f5227a1172cbd3293e

    • SHA256

      8669409e56243e4b34c5418783f9b4c0ee6719214fbcc4296f451f51f687beaa

    • SHA512

      a003924438ad839eedecdfc3e8feb5fce0900344298353f8d39ad42818526780adda352fa27926fb3a3b868bf6f4bb384b4740cfd7bcf9eda1f10cc3e6ff58f5

    • SSDEEP

      12288:zMrsy905Jw/QVDEJedgAQLcdSx1ka8ORHKB:DyidVgeWAQLjMORqB

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks