General

  • Target

    41dc70a31791550d0ef1dc91129904dc088a68ecbef38a4327e4c42daf7879ab

  • Size

    795KB

  • Sample

    241110-nrgbtawepc

  • MD5

    a6eba701620ca45d63ae957f5670b62e

  • SHA1

    f24f9606ae0e2c51f010f2b1acc2facd60593e83

  • SHA256

    41dc70a31791550d0ef1dc91129904dc088a68ecbef38a4327e4c42daf7879ab

  • SHA512

    afb41ddea5da48718d05fb01c979093511f6ca3a9c7ff4afd4d1dfba1e77e396fc508613ee65fcfdbde6b64485afe6f5f19d71cc10bff8bcc631201ba3af154d

  • SSDEEP

    12288:5y90M8dwSBpsAC/v9nMBMqkACqXFoTZq5Ip/p5BQ8QBb+3q6680kzuLP3:5yYwSBpU/vJCtOg9+xm

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dante

C2

185.161.248.73:4164

Attributes
  • auth_value

    f4066af6b8a6f23125c8ee48288a3f90

Targets

    • Target

      41dc70a31791550d0ef1dc91129904dc088a68ecbef38a4327e4c42daf7879ab

    • Size

      795KB

    • MD5

      a6eba701620ca45d63ae957f5670b62e

    • SHA1

      f24f9606ae0e2c51f010f2b1acc2facd60593e83

    • SHA256

      41dc70a31791550d0ef1dc91129904dc088a68ecbef38a4327e4c42daf7879ab

    • SHA512

      afb41ddea5da48718d05fb01c979093511f6ca3a9c7ff4afd4d1dfba1e77e396fc508613ee65fcfdbde6b64485afe6f5f19d71cc10bff8bcc631201ba3af154d

    • SSDEEP

      12288:5y90M8dwSBpsAC/v9nMBMqkACqXFoTZq5Ip/p5BQ8QBb+3q6680kzuLP3:5yYwSBpU/vJCtOg9+xm

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks