General

  • Target

    66b1207ca5f75785cca90d85d7d547857e41f342b5a8d3bd3f26c4356caf55b2

  • Size

    1.1MB

  • Sample

    241111-b7271azclr

  • MD5

    9875a70a4089f50591d8e3cfc265c6fa

  • SHA1

    50fea92e5ad909305ad035afe4bfe331b8b1c7dd

  • SHA256

    66b1207ca5f75785cca90d85d7d547857e41f342b5a8d3bd3f26c4356caf55b2

  • SHA512

    d20a28eeeb054d9716917c2aa5a214f342c5afa23d67e9a1ae7cd8135acc2abb9bfcb233cd1278022545c19a8d3bfbc3ab612afe55b0f1e595a1dd6791c598ea

  • SSDEEP

    24576:kyQYeG+EkmDbp+KXWJr7lip6GbntRtdjtfkshRO64fR+hj:zLLJz8KGJVYr16p+h

Malware Config

Extracted

Family

redline

Botnet

dizan

C2

185.161.248.75:4132

Attributes
  • auth_value

    b14d665c7bca8407646527036302d70c

Targets

    • Target

      66b1207ca5f75785cca90d85d7d547857e41f342b5a8d3bd3f26c4356caf55b2

    • Size

      1.1MB

    • MD5

      9875a70a4089f50591d8e3cfc265c6fa

    • SHA1

      50fea92e5ad909305ad035afe4bfe331b8b1c7dd

    • SHA256

      66b1207ca5f75785cca90d85d7d547857e41f342b5a8d3bd3f26c4356caf55b2

    • SHA512

      d20a28eeeb054d9716917c2aa5a214f342c5afa23d67e9a1ae7cd8135acc2abb9bfcb233cd1278022545c19a8d3bfbc3ab612afe55b0f1e595a1dd6791c598ea

    • SSDEEP

      24576:kyQYeG+EkmDbp+KXWJr7lip6GbntRtdjtfkshRO64fR+hj:zLLJz8KGJVYr16p+h

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks