General

  • Target

    7b3bddd75effc105077d4f624ed5f3cff3092521a48a07409ae2349ebc02640c

  • Size

    567KB

  • Sample

    241110-zq7m6avgmd

  • MD5

    fe3229bbd14f818dcf11ae66c574f246

  • SHA1

    443ce1259689bcfabe1eda4fa6e0a77dee414957

  • SHA256

    7b3bddd75effc105077d4f624ed5f3cff3092521a48a07409ae2349ebc02640c

  • SHA512

    d861475c25cb9a3861c19f1fc9f599ed3fbc9bcbf1ba01c31dd16b3e7623bbb70232386b5e85b88e24c05001a2bac0ae8cf60fc602b1e3665fd124d4eec35447

  • SSDEEP

    12288:kMr1y90onZ46HdgkAmTx68TKZN1ci6uf:pyXnxdF9TxgMPuf

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Targets

    • Target

      7b3bddd75effc105077d4f624ed5f3cff3092521a48a07409ae2349ebc02640c

    • Size

      567KB

    • MD5

      fe3229bbd14f818dcf11ae66c574f246

    • SHA1

      443ce1259689bcfabe1eda4fa6e0a77dee414957

    • SHA256

      7b3bddd75effc105077d4f624ed5f3cff3092521a48a07409ae2349ebc02640c

    • SHA512

      d861475c25cb9a3861c19f1fc9f599ed3fbc9bcbf1ba01c31dd16b3e7623bbb70232386b5e85b88e24c05001a2bac0ae8cf60fc602b1e3665fd124d4eec35447

    • SSDEEP

      12288:kMr1y90onZ46HdgkAmTx68TKZN1ci6uf:pyXnxdF9TxgMPuf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks