General

  • Target

    2265eacd76517f77ebb7007876656dd0153ca63e515158509cda25a128985a30

  • Size

    739KB

  • Sample

    241111-a9lglayepr

  • MD5

    15d5e3180cdd4ecd84fb126c22842382

  • SHA1

    b24d584f33be42b9ec909c84da5722ffa9e2f82f

  • SHA256

    2265eacd76517f77ebb7007876656dd0153ca63e515158509cda25a128985a30

  • SHA512

    e6bd03d60c9a9df23b6af1313972f8094f41fcfdb87633a725e450ea79eb6ac72b60ee966414215361d34bf804b879de1671c473a34621c02f69e6b505be58a5

  • SSDEEP

    12288:VMrNy902AC4CiE7uYBco+AeGdtolfQxOEU87IuqQ0mvh0L2u8T:4yV7uPVhlfQxOEL8u1vM2uW

Malware Config

Extracted

Family

redline

Botnet

ruma

C2

193.233.20.13:4136

Attributes
  • auth_value

    647d00dfaba082a4a30f383bca5d1a2a

Targets

    • Target

      2265eacd76517f77ebb7007876656dd0153ca63e515158509cda25a128985a30

    • Size

      739KB

    • MD5

      15d5e3180cdd4ecd84fb126c22842382

    • SHA1

      b24d584f33be42b9ec909c84da5722ffa9e2f82f

    • SHA256

      2265eacd76517f77ebb7007876656dd0153ca63e515158509cda25a128985a30

    • SHA512

      e6bd03d60c9a9df23b6af1313972f8094f41fcfdb87633a725e450ea79eb6ac72b60ee966414215361d34bf804b879de1671c473a34621c02f69e6b505be58a5

    • SSDEEP

      12288:VMrNy902AC4CiE7uYBco+AeGdtolfQxOEU87IuqQ0mvh0L2u8T:4yV7uPVhlfQxOEL8u1vM2uW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks