General

  • Target

    829bd36c2675fbdb1f11289de2df68a3e7c3683f7f8d6705f579e83cd88e0350

  • Size

    479KB

  • Sample

    241110-z4dbgaylcl

  • MD5

    951e5b1e46d897e68d9bb04f79df6620

  • SHA1

    32b026ba046efa50813e4de552820effad59330b

  • SHA256

    829bd36c2675fbdb1f11289de2df68a3e7c3683f7f8d6705f579e83cd88e0350

  • SHA512

    e733e10313976fef4926184d05f98a73bdbc1df7575a8de4706c28fd035a30c52483b6941ad1e377d3a257eb1dbb0348470e2664139ba0f389c2aa04d9c8df55

  • SSDEEP

    12288:wMrcy90KWIf82GoGXDBwYhDca88BOMCJh4u:8yBlCDaYhDca1OMCIu

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      829bd36c2675fbdb1f11289de2df68a3e7c3683f7f8d6705f579e83cd88e0350

    • Size

      479KB

    • MD5

      951e5b1e46d897e68d9bb04f79df6620

    • SHA1

      32b026ba046efa50813e4de552820effad59330b

    • SHA256

      829bd36c2675fbdb1f11289de2df68a3e7c3683f7f8d6705f579e83cd88e0350

    • SHA512

      e733e10313976fef4926184d05f98a73bdbc1df7575a8de4706c28fd035a30c52483b6941ad1e377d3a257eb1dbb0348470e2664139ba0f389c2aa04d9c8df55

    • SSDEEP

      12288:wMrcy90KWIf82GoGXDBwYhDca88BOMCJh4u:8yBlCDaYhDca1OMCIu

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks