General

  • Target

    7918594ac542c92465d932c7603f261b5d4d4ba223bdeb3b1e31591bb6c13211

  • Size

    829KB

  • Sample

    241111-ac87ds1mek

  • MD5

    786992f66178c6e340990b404ea6849e

  • SHA1

    0032a6a088a0b0123cb3d2d88eb149d983071dc3

  • SHA256

    7918594ac542c92465d932c7603f261b5d4d4ba223bdeb3b1e31591bb6c13211

  • SHA512

    dc41310921788e2a09e9e6d40b9227d1ec59ce2fe5f222b9985fdcacb9cedc5948546dd53b8844aadb51de22e90678172a99742f03d91fedd20367c9103e29ca

  • SSDEEP

    12288:cy904s3gh4Jph8vmTUOfzFSb2N4kybwE2CeqMGSl7npIO6mMcI14YHvM:cyq3gh4PNJbi22k2yAVq9bI14X

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      7918594ac542c92465d932c7603f261b5d4d4ba223bdeb3b1e31591bb6c13211

    • Size

      829KB

    • MD5

      786992f66178c6e340990b404ea6849e

    • SHA1

      0032a6a088a0b0123cb3d2d88eb149d983071dc3

    • SHA256

      7918594ac542c92465d932c7603f261b5d4d4ba223bdeb3b1e31591bb6c13211

    • SHA512

      dc41310921788e2a09e9e6d40b9227d1ec59ce2fe5f222b9985fdcacb9cedc5948546dd53b8844aadb51de22e90678172a99742f03d91fedd20367c9103e29ca

    • SSDEEP

      12288:cy904s3gh4Jph8vmTUOfzFSb2N4kybwE2CeqMGSl7npIO6mMcI14YHvM:cyq3gh4PNJbi22k2yAVq9bI14X

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks