General

  • Target

    15c0014a2da25424e9f1711f9c95aa0944571ac6ea721a1ea2e85a9b7d2d638f

  • Size

    479KB

  • Sample

    241110-l19cvavdrf

  • MD5

    153f5137a6ee29cef6bae47b41df07a0

  • SHA1

    2c43f570ee05806bda3e8616cd2ec6d813de1e2f

  • SHA256

    15c0014a2da25424e9f1711f9c95aa0944571ac6ea721a1ea2e85a9b7d2d638f

  • SHA512

    b7f3697a7371ff1678deba719d6ffd2d05a8de02110f89eddb05e459dc3d723ccbfab799a7967a6d7ad02aec1e1efa3b47bfd21f4673f10d0df0d7ff9e5e29f1

  • SSDEEP

    12288:4Mrwy90/qni7FTNk8dMA8yWFcUMEPu+jeala1Rm:Yyyq/g0rSm

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      15c0014a2da25424e9f1711f9c95aa0944571ac6ea721a1ea2e85a9b7d2d638f

    • Size

      479KB

    • MD5

      153f5137a6ee29cef6bae47b41df07a0

    • SHA1

      2c43f570ee05806bda3e8616cd2ec6d813de1e2f

    • SHA256

      15c0014a2da25424e9f1711f9c95aa0944571ac6ea721a1ea2e85a9b7d2d638f

    • SHA512

      b7f3697a7371ff1678deba719d6ffd2d05a8de02110f89eddb05e459dc3d723ccbfab799a7967a6d7ad02aec1e1efa3b47bfd21f4673f10d0df0d7ff9e5e29f1

    • SSDEEP

      12288:4Mrwy90/qni7FTNk8dMA8yWFcUMEPu+jeala1Rm:Yyyq/g0rSm

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks