General

  • Target

    84a46b45248d9574c67b244a675456730160b3e6f235df40178e3ce56957b3cc

  • Size

    480KB

  • Sample

    241110-z1afeavfjp

  • MD5

    128873a8aa140e222e79ca1b9a913f01

  • SHA1

    d6b69c29ceeb681784d4eb0871f3c17c34d09ff7

  • SHA256

    84a46b45248d9574c67b244a675456730160b3e6f235df40178e3ce56957b3cc

  • SHA512

    6448b54630c3784029cf4e59f31846881b08f44db52631d1464fcc623554507ad247efd2eeecd9cdb1573597b9539201e4854f2be7cdfd852ce69ccc38680956

  • SSDEEP

    12288:GMr2y90wRhs/aqj9yHTCXifKNfuDM38r5pxj6o9:cy1FVfa8rBj7

Malware Config

Extracted

Family

redline

Botnet

dariy

C2

217.196.96.101:4132

Attributes
  • auth_value

    2f34aa0d1cb1023a826825b68ebedcc8

Targets

    • Target

      84a46b45248d9574c67b244a675456730160b3e6f235df40178e3ce56957b3cc

    • Size

      480KB

    • MD5

      128873a8aa140e222e79ca1b9a913f01

    • SHA1

      d6b69c29ceeb681784d4eb0871f3c17c34d09ff7

    • SHA256

      84a46b45248d9574c67b244a675456730160b3e6f235df40178e3ce56957b3cc

    • SHA512

      6448b54630c3784029cf4e59f31846881b08f44db52631d1464fcc623554507ad247efd2eeecd9cdb1573597b9539201e4854f2be7cdfd852ce69ccc38680956

    • SSDEEP

      12288:GMr2y90wRhs/aqj9yHTCXifKNfuDM38r5pxj6o9:cy1FVfa8rBj7

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks