General

  • Target

    935f9a9cbf04c70fe250b9726543cbed80d0f5dde4e16beab2d176e65d92a1a7

  • Size

    478KB

  • Sample

    241111-ajnh9sycrf

  • MD5

    1ab7d6eebc42bef8d9479ef71193b52c

  • SHA1

    10a2cc931a922b102dff82af7ea6a66623d9b339

  • SHA256

    935f9a9cbf04c70fe250b9726543cbed80d0f5dde4e16beab2d176e65d92a1a7

  • SHA512

    da930b8e5ef60f6545e893cec3ba605d96c2623333153a60a9cf5554898aac9735b21cf633830f4321c31d716d5501cae303d49440896c1f209a368df8c3c0d6

  • SSDEEP

    12288:LMrFy90eGMAH6V8WehVVRGZsCKNHespCk:GyOMJVYBpxN+CCk

Malware Config

Extracted

Family

redline

Botnet

fusa

C2

193.233.20.12:4132

Attributes
  • auth_value

    a08b2f01bd2af756e38c5dd60e87e697

Targets

    • Target

      935f9a9cbf04c70fe250b9726543cbed80d0f5dde4e16beab2d176e65d92a1a7

    • Size

      478KB

    • MD5

      1ab7d6eebc42bef8d9479ef71193b52c

    • SHA1

      10a2cc931a922b102dff82af7ea6a66623d9b339

    • SHA256

      935f9a9cbf04c70fe250b9726543cbed80d0f5dde4e16beab2d176e65d92a1a7

    • SHA512

      da930b8e5ef60f6545e893cec3ba605d96c2623333153a60a9cf5554898aac9735b21cf633830f4321c31d716d5501cae303d49440896c1f209a368df8c3c0d6

    • SSDEEP

      12288:LMrFy90eGMAH6V8WehVVRGZsCKNHespCk:GyOMJVYBpxN+CCk

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks