General

  • Target

    3df76763e02b01e49120b4185262a82e3b25d312f8180422aeb64da832f6d1dd

  • Size

    1.1MB

  • Sample

    241110-kts7lswqhp

  • MD5

    8b635a98bee9f5ff1feaf61fedbd51a9

  • SHA1

    dd6f2bbc263fcdbf6c6223c1049251b65f93b53b

  • SHA256

    3df76763e02b01e49120b4185262a82e3b25d312f8180422aeb64da832f6d1dd

  • SHA512

    4065e99292fae75eef6de1c339fc7952db4dbd700e45ef26f1ebb97566453b6dc1c2673821a77f20746e88d229304a80e6cfbc896d1a281cd070374a32e54c6d

  • SSDEEP

    24576:ay4OUxPGTzsQ3ia11r8wadcU6xnDELRZIrQM1kRXWNFUDentRwt4Fa:h4KPn3iaDgLRZAQxRXW3UIwSF

Malware Config

Extracted

Family

redline

Botnet

doma

C2

185.161.248.75:4132

Attributes
  • auth_value

    8be53af7f78567706928d0abef953ef4

Targets

    • Target

      3df76763e02b01e49120b4185262a82e3b25d312f8180422aeb64da832f6d1dd

    • Size

      1.1MB

    • MD5

      8b635a98bee9f5ff1feaf61fedbd51a9

    • SHA1

      dd6f2bbc263fcdbf6c6223c1049251b65f93b53b

    • SHA256

      3df76763e02b01e49120b4185262a82e3b25d312f8180422aeb64da832f6d1dd

    • SHA512

      4065e99292fae75eef6de1c339fc7952db4dbd700e45ef26f1ebb97566453b6dc1c2673821a77f20746e88d229304a80e6cfbc896d1a281cd070374a32e54c6d

    • SSDEEP

      24576:ay4OUxPGTzsQ3ia11r8wadcU6xnDELRZIrQM1kRXWNFUDentRwt4Fa:h4KPn3iaDgLRZAQxRXW3UIwSF

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks