General

  • Target

    9e3ee3ffb177714fd55fe71ae62ef45f97caba3740b25f25b6a14e2719c02430

  • Size

    565KB

  • Sample

    241110-yhyvlsxjbp

  • MD5

    76511fc8eb651a3ec5ac8091740a1276

  • SHA1

    406fe03707bce088062f69b7217b1d6bba9c84ec

  • SHA256

    9e3ee3ffb177714fd55fe71ae62ef45f97caba3740b25f25b6a14e2719c02430

  • SHA512

    bea711095d60a37e0f63444fed0a3096d6ad20672a749e6151e98900fb0dd7e3706ade51691ac553d3d97cb9cce7902e8174c33e9f2e733505c6d0838676ac1e

  • SSDEEP

    12288:3Mr2y90tlhHIq6RcGTgQHvgazf3Ku+mV2U0tC6QJZYPB:dymlZev5f3KEEUlZYJ

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Targets

    • Target

      9e3ee3ffb177714fd55fe71ae62ef45f97caba3740b25f25b6a14e2719c02430

    • Size

      565KB

    • MD5

      76511fc8eb651a3ec5ac8091740a1276

    • SHA1

      406fe03707bce088062f69b7217b1d6bba9c84ec

    • SHA256

      9e3ee3ffb177714fd55fe71ae62ef45f97caba3740b25f25b6a14e2719c02430

    • SHA512

      bea711095d60a37e0f63444fed0a3096d6ad20672a749e6151e98900fb0dd7e3706ade51691ac553d3d97cb9cce7902e8174c33e9f2e733505c6d0838676ac1e

    • SSDEEP

      12288:3Mr2y90tlhHIq6RcGTgQHvgazf3Ku+mV2U0tC6QJZYPB:dymlZev5f3KEEUlZYJ

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks