General

  • Target

    257a2a92d94a2268bc2bb34d6488d2e44db314051cc33ea01e905faab1741429

  • Size

    479KB

  • Sample

    241110-jt2y3ssgll

  • MD5

    d6eddde5086af38aa7218f22c8232e2d

  • SHA1

    a0a4860585cdfdd26bf4ee8649c8b3eb1a72df4b

  • SHA256

    257a2a92d94a2268bc2bb34d6488d2e44db314051cc33ea01e905faab1741429

  • SHA512

    36cb41f2ddf42cef279e44c8307ee39a5e667fd543717f98c5e5e7096acc0f047880c149f658cf14149cc1e97ef0e7121b4e94e3120db66541c695dac8aa555e

  • SSDEEP

    12288:vMr+y90Lykw7egV+gDYK+lUPLlSe88zF:Ryu98+Qojk

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      257a2a92d94a2268bc2bb34d6488d2e44db314051cc33ea01e905faab1741429

    • Size

      479KB

    • MD5

      d6eddde5086af38aa7218f22c8232e2d

    • SHA1

      a0a4860585cdfdd26bf4ee8649c8b3eb1a72df4b

    • SHA256

      257a2a92d94a2268bc2bb34d6488d2e44db314051cc33ea01e905faab1741429

    • SHA512

      36cb41f2ddf42cef279e44c8307ee39a5e667fd543717f98c5e5e7096acc0f047880c149f658cf14149cc1e97ef0e7121b4e94e3120db66541c695dac8aa555e

    • SSDEEP

      12288:vMr+y90Lykw7egV+gDYK+lUPLlSe88zF:Ryu98+Qojk

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks