General

  • Target

    6c583f8da712ca1e986ec370aaaaa8e4537409df228c46d2de16fc43f85520a2

  • Size

    480KB

  • Sample

    241110-ja1a5s1rax

  • MD5

    164d2d04faaab7215293b747ecf242dd

  • SHA1

    d031995969ffc6c39b699948040dafc75cfb1046

  • SHA256

    6c583f8da712ca1e986ec370aaaaa8e4537409df228c46d2de16fc43f85520a2

  • SHA512

    edb732f4ce251b7e9b97eb597e2a29219da13b0535283e475c28369910b4798b7b6fd460c45087456676d564c957a458a9f8d6fe3bfaecc246b5711e1e9407d5

  • SSDEEP

    12288:AMr7y90ML/XCCeF05SCHjpH0xI9Ix2oZo:ry9jCPTCH9HPlOo

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      6c583f8da712ca1e986ec370aaaaa8e4537409df228c46d2de16fc43f85520a2

    • Size

      480KB

    • MD5

      164d2d04faaab7215293b747ecf242dd

    • SHA1

      d031995969ffc6c39b699948040dafc75cfb1046

    • SHA256

      6c583f8da712ca1e986ec370aaaaa8e4537409df228c46d2de16fc43f85520a2

    • SHA512

      edb732f4ce251b7e9b97eb597e2a29219da13b0535283e475c28369910b4798b7b6fd460c45087456676d564c957a458a9f8d6fe3bfaecc246b5711e1e9407d5

    • SSDEEP

      12288:AMr7y90ML/XCCeF05SCHjpH0xI9Ix2oZo:ry9jCPTCH9HPlOo

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks