General

  • Target

    898c446da36a720aac65d12aa9f196dbab883fb48c8206924acc3d5b7d2f9b35

  • Size

    479KB

  • Sample

    241111-adxvraxhlm

  • MD5

    75fb503f52e75de415391efcb3234d43

  • SHA1

    b570d225b7ccfb7b10d4270e16c2cd096c3c0439

  • SHA256

    898c446da36a720aac65d12aa9f196dbab883fb48c8206924acc3d5b7d2f9b35

  • SHA512

    68dfd97cd7cf9b789d61c4328790f5ba4587f7e3f7c9eb6efc4d2dd8ddb50dfe69d196bfe4c706024da887ac98a3eef4998e5c27790793b619b481e9a09170b9

  • SSDEEP

    12288:LMrCy90xgN17fFWZe9M1gXfwmvKA7Ke8asyh2:5yQO7fF4e+1gTiwKhyw

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes
  • auth_value

    9fbb198992bbc83a84ab1f21384813e3

Targets

    • Target

      898c446da36a720aac65d12aa9f196dbab883fb48c8206924acc3d5b7d2f9b35

    • Size

      479KB

    • MD5

      75fb503f52e75de415391efcb3234d43

    • SHA1

      b570d225b7ccfb7b10d4270e16c2cd096c3c0439

    • SHA256

      898c446da36a720aac65d12aa9f196dbab883fb48c8206924acc3d5b7d2f9b35

    • SHA512

      68dfd97cd7cf9b789d61c4328790f5ba4587f7e3f7c9eb6efc4d2dd8ddb50dfe69d196bfe4c706024da887ac98a3eef4998e5c27790793b619b481e9a09170b9

    • SSDEEP

      12288:LMrCy90xgN17fFWZe9M1gXfwmvKA7Ke8asyh2:5yQO7fF4e+1gTiwKhyw

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks