General

  • Target

    43453281c611e5d3ad4ed448492164e7afa4b3f76b477ff8921541e7024d1e75

  • Size

    554KB

  • Sample

    241110-km5l3atdqf

  • MD5

    8c5e2230192e77523c333518980fc452

  • SHA1

    c359111453f2e5c7c52bd48ca63ad7a6a19fca09

  • SHA256

    43453281c611e5d3ad4ed448492164e7afa4b3f76b477ff8921541e7024d1e75

  • SHA512

    e215a40c8bd7bad49d0a65bedb6453962a86bf69404645d6a37ce1592dfbd1e62af0a56021fad0b77ea9a2ecc758957ecd6513e07c23f3ca242f8e70fb5c2fc3

  • SSDEEP

    12288:qMrcy90XasugPZHlgbXHggNyN8SPmmv48q7hXoADqC:6ylszPdlDgNyNflvq7mA1

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Targets

    • Target

      43453281c611e5d3ad4ed448492164e7afa4b3f76b477ff8921541e7024d1e75

    • Size

      554KB

    • MD5

      8c5e2230192e77523c333518980fc452

    • SHA1

      c359111453f2e5c7c52bd48ca63ad7a6a19fca09

    • SHA256

      43453281c611e5d3ad4ed448492164e7afa4b3f76b477ff8921541e7024d1e75

    • SHA512

      e215a40c8bd7bad49d0a65bedb6453962a86bf69404645d6a37ce1592dfbd1e62af0a56021fad0b77ea9a2ecc758957ecd6513e07c23f3ca242f8e70fb5c2fc3

    • SSDEEP

      12288:qMrcy90XasugPZHlgbXHggNyN8SPmmv48q7hXoADqC:6ylszPdlDgNyNflvq7mA1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks