General

  • Target

    8482a697bab0fe94c3d2347e37d0783c51c4ead9def5cdc9e7c6fd3509c7bc51

  • Size

    479KB

  • Sample

    241111-bjg7xsygkm

  • MD5

    c24a46f4b334e64a8cb4602af16053af

  • SHA1

    75db104f83fdf5e213870e51789511bc4eee8aea

  • SHA256

    8482a697bab0fe94c3d2347e37d0783c51c4ead9def5cdc9e7c6fd3509c7bc51

  • SHA512

    4c39e535f4c0a209c5b892323f3082879c4d5fb015c5206c121806fe86491638cefab85249883ad2c6e11de11794fb7f2362b23e71c3be053e9d1327ee24e6d4

  • SSDEEP

    12288:4Mr2y90MFK9T4QHA8LjlARpe1tKntX/bLBfDaa:+yS9fPjK0ctX/5aa

Malware Config

Extracted

Family

redline

Botnet

dariy

C2

217.196.96.101:4132

Attributes
  • auth_value

    2f34aa0d1cb1023a826825b68ebedcc8

Targets

    • Target

      8482a697bab0fe94c3d2347e37d0783c51c4ead9def5cdc9e7c6fd3509c7bc51

    • Size

      479KB

    • MD5

      c24a46f4b334e64a8cb4602af16053af

    • SHA1

      75db104f83fdf5e213870e51789511bc4eee8aea

    • SHA256

      8482a697bab0fe94c3d2347e37d0783c51c4ead9def5cdc9e7c6fd3509c7bc51

    • SHA512

      4c39e535f4c0a209c5b892323f3082879c4d5fb015c5206c121806fe86491638cefab85249883ad2c6e11de11794fb7f2362b23e71c3be053e9d1327ee24e6d4

    • SSDEEP

      12288:4Mr2y90MFK9T4QHA8LjlARpe1tKntX/bLBfDaa:+yS9fPjK0ctX/5aa

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks