General

  • Target

    df110bf94adc0907f7dd3db6e56001de7c94815d0aab36e4dc7071a1756358c5

  • Size

    479KB

  • Sample

    241110-r1qtdsxrhs

  • MD5

    52c53e8388e327bc5c325fc2122db3ef

  • SHA1

    29591c7a68311854a8477ffdb4e11619515387ca

  • SHA256

    df110bf94adc0907f7dd3db6e56001de7c94815d0aab36e4dc7071a1756358c5

  • SHA512

    2b43669694323a2e3ae3be24bf8e2b92fe56a3c2a876f839061c690615edf76281c5bda728cd38a8238c95d47c9893d7ac67d645305059ede9eba6dbc96048b9

  • SSDEEP

    12288:KMrky90KQUV5GE0Hfb3NLY4TkiHbStcI9eW:Ky3JV5boBYC4tZ9eW

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      df110bf94adc0907f7dd3db6e56001de7c94815d0aab36e4dc7071a1756358c5

    • Size

      479KB

    • MD5

      52c53e8388e327bc5c325fc2122db3ef

    • SHA1

      29591c7a68311854a8477ffdb4e11619515387ca

    • SHA256

      df110bf94adc0907f7dd3db6e56001de7c94815d0aab36e4dc7071a1756358c5

    • SHA512

      2b43669694323a2e3ae3be24bf8e2b92fe56a3c2a876f839061c690615edf76281c5bda728cd38a8238c95d47c9893d7ac67d645305059ede9eba6dbc96048b9

    • SSDEEP

      12288:KMrky90KQUV5GE0Hfb3NLY4TkiHbStcI9eW:Ky3JV5boBYC4tZ9eW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks