General

  • Target

    590ee6cf7604c0df61015ec8249358d97ae78c7e1579856c8d92643aeac835f8

  • Size

    480KB

  • Sample

    241110-lwj76avcrg

  • MD5

    1d0f8ff10562e18041cf434738ec0cf3

  • SHA1

    986bc41b19ffd155190a8c7abfd2998483d23b38

  • SHA256

    590ee6cf7604c0df61015ec8249358d97ae78c7e1579856c8d92643aeac835f8

  • SHA512

    b4a3c8b778f642d39a9217d8d019cf3047938ab18d14470692892f561c5dc3bfdaad6dbfd544534dd907db0780a6db1f06213c2275bf0170587d823efef7f681

  • SSDEEP

    12288:nMroy90NskZlLwou9RKqO6rJUTkP3xtvyhgqv:3ycx2U3TkP3xtKhJv

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      590ee6cf7604c0df61015ec8249358d97ae78c7e1579856c8d92643aeac835f8

    • Size

      480KB

    • MD5

      1d0f8ff10562e18041cf434738ec0cf3

    • SHA1

      986bc41b19ffd155190a8c7abfd2998483d23b38

    • SHA256

      590ee6cf7604c0df61015ec8249358d97ae78c7e1579856c8d92643aeac835f8

    • SHA512

      b4a3c8b778f642d39a9217d8d019cf3047938ab18d14470692892f561c5dc3bfdaad6dbfd544534dd907db0780a6db1f06213c2275bf0170587d823efef7f681

    • SSDEEP

      12288:nMroy90NskZlLwou9RKqO6rJUTkP3xtvyhgqv:3ycx2U3TkP3xtKhJv

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks