General

  • Target

    acb336105c3eb47b8d0546d20f94213338ef7a3d1f45618fb04c00dcafd12a0b

  • Size

    476KB

  • Sample

    241111-bh8ngszbmh

  • MD5

    5eaa3f1fcb2df8bce4a2aa5ca91eb4f6

  • SHA1

    9543231b1aaac980e527f03912c81d41d4d3479a

  • SHA256

    acb336105c3eb47b8d0546d20f94213338ef7a3d1f45618fb04c00dcafd12a0b

  • SHA512

    1c392fb9d3a368c829b904fe588752d01a337220ceea8be3473b45ecd96e4fe4fe14531de3bbcc8b48021eea45501c3d9fa923fb9589615ab8df6a57aadb8493

  • SSDEEP

    12288:QMrcy902gHh00VDXvKIrW0iuEU+8h5XO8T0:cy9CvVDDiCH5Tg

Malware Config

Extracted

Family

redline

Botnet

fuka

C2

193.233.20.11:4131

Attributes
  • auth_value

    90eef520554ef188793d77ecc34217bf

Targets

    • Target

      acb336105c3eb47b8d0546d20f94213338ef7a3d1f45618fb04c00dcafd12a0b

    • Size

      476KB

    • MD5

      5eaa3f1fcb2df8bce4a2aa5ca91eb4f6

    • SHA1

      9543231b1aaac980e527f03912c81d41d4d3479a

    • SHA256

      acb336105c3eb47b8d0546d20f94213338ef7a3d1f45618fb04c00dcafd12a0b

    • SHA512

      1c392fb9d3a368c829b904fe588752d01a337220ceea8be3473b45ecd96e4fe4fe14531de3bbcc8b48021eea45501c3d9fa923fb9589615ab8df6a57aadb8493

    • SSDEEP

      12288:QMrcy902gHh00VDXvKIrW0iuEU+8h5XO8T0:cy9CvVDDiCH5Tg

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks