General

  • Target

    1daa51d53c5b57c615aa1eb89d52721e1fb93c8bdc32c63877d6b46efc1221e3

  • Size

    479KB

  • Sample

    241110-zlpxjsvfnc

  • MD5

    f701a5c9072e1bc7c49dc8d31eb4206c

  • SHA1

    f98b798bfc78f3dd5534c05d3be2bd1da94d13c0

  • SHA256

    1daa51d53c5b57c615aa1eb89d52721e1fb93c8bdc32c63877d6b46efc1221e3

  • SHA512

    999672420eda3cb1b82f3acc5346b5eda4e97d22f6867c4d6b42c16bbaf28b186a86db2549f0676401d155334987c68e17409f14f593e8aa0cea9ec077ad479a

  • SSDEEP

    12288:PMrqy90+RXqWoFKW107kc94WPDFZRk659vj:tyxXqWl7kc94APGuV

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      1daa51d53c5b57c615aa1eb89d52721e1fb93c8bdc32c63877d6b46efc1221e3

    • Size

      479KB

    • MD5

      f701a5c9072e1bc7c49dc8d31eb4206c

    • SHA1

      f98b798bfc78f3dd5534c05d3be2bd1da94d13c0

    • SHA256

      1daa51d53c5b57c615aa1eb89d52721e1fb93c8bdc32c63877d6b46efc1221e3

    • SHA512

      999672420eda3cb1b82f3acc5346b5eda4e97d22f6867c4d6b42c16bbaf28b186a86db2549f0676401d155334987c68e17409f14f593e8aa0cea9ec077ad479a

    • SSDEEP

      12288:PMrqy90+RXqWoFKW107kc94WPDFZRk659vj:tyxXqWl7kc94APGuV

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks