General

  • Target

    713a68e602a1f81948a238ea082df2794dd895aa365a9e910cf6f45d49c5f092

  • Size

    437KB

  • Sample

    241110-z7yftavmdx

  • MD5

    183394d1e13816a376c7c51ed9ecc829

  • SHA1

    8492355b641c80aac7340618d07c9dc3fc7268c4

  • SHA256

    713a68e602a1f81948a238ea082df2794dd895aa365a9e910cf6f45d49c5f092

  • SHA512

    a7f25f1d612b6382c7a5d250d5bd526b69d77b15b446f2954cd42899055e9daa0e603a82a3c00bdbb97339871af4ca77dc02e2c03a10f2291e6df725a8557d0f

  • SSDEEP

    12288:iMrBy90cXcQk3o8HSfpzV+/Hu6Ky6GusYDl:byXmbSfpZ+/u6KVGusYDl

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes
  • auth_value

    f88f86755a528d4b25f6f3628c460965

Targets

    • Target

      713a68e602a1f81948a238ea082df2794dd895aa365a9e910cf6f45d49c5f092

    • Size

      437KB

    • MD5

      183394d1e13816a376c7c51ed9ecc829

    • SHA1

      8492355b641c80aac7340618d07c9dc3fc7268c4

    • SHA256

      713a68e602a1f81948a238ea082df2794dd895aa365a9e910cf6f45d49c5f092

    • SHA512

      a7f25f1d612b6382c7a5d250d5bd526b69d77b15b446f2954cd42899055e9daa0e603a82a3c00bdbb97339871af4ca77dc02e2c03a10f2291e6df725a8557d0f

    • SSDEEP

      12288:iMrBy90cXcQk3o8HSfpzV+/Hu6Ky6GusYDl:byXmbSfpZ+/u6KVGusYDl

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks