General

  • Target

    71aca3cdfa69a4e324c758d359610fedab8dc629c3f00af2af04d2e3b725f4ac

  • Size

    480KB

  • Sample

    241111-bbrfmayjhs

  • MD5

    1c4c086911c696cd2d66f744715f63ce

  • SHA1

    687eafdd63841cf4d639f6c295bd7075d9c4a6a5

  • SHA256

    71aca3cdfa69a4e324c758d359610fedab8dc629c3f00af2af04d2e3b725f4ac

  • SHA512

    478d0ad74b16482b121ecdc2dd328191b6b47331032d8cea17e093d214127ae96f42ce9ce0660952dd6641e675f830c46b7aa4e4b49119e1c806367481554e4f

  • SSDEEP

    12288:KMr8y90/Mm04lWQX4AWhSqzOFFYDZVTsA2l7S:Kyc0WIAczcFiIS

Malware Config

Extracted

Family

redline

Botnet

domor

C2

217.196.96.101:4132

Attributes
  • auth_value

    39471bda00546bb0435bc7adfd6881dc

Targets

    • Target

      71aca3cdfa69a4e324c758d359610fedab8dc629c3f00af2af04d2e3b725f4ac

    • Size

      480KB

    • MD5

      1c4c086911c696cd2d66f744715f63ce

    • SHA1

      687eafdd63841cf4d639f6c295bd7075d9c4a6a5

    • SHA256

      71aca3cdfa69a4e324c758d359610fedab8dc629c3f00af2af04d2e3b725f4ac

    • SHA512

      478d0ad74b16482b121ecdc2dd328191b6b47331032d8cea17e093d214127ae96f42ce9ce0660952dd6641e675f830c46b7aa4e4b49119e1c806367481554e4f

    • SSDEEP

      12288:KMr8y90/Mm04lWQX4AWhSqzOFFYDZVTsA2l7S:Kyc0WIAczcFiIS

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks