General

  • Target

    33e4a4b7324d07b7822898341f1ec228e203752bd76fa02d875f8c3b594fc44d

  • Size

    479KB

  • Sample

    241111-bk4sbayld1

  • MD5

    2f6a263f0ec86f2b68a6b076e2bf9aa7

  • SHA1

    8a725c5f5c9f663b8dcc47261b81fe5a8f1b522d

  • SHA256

    33e4a4b7324d07b7822898341f1ec228e203752bd76fa02d875f8c3b594fc44d

  • SHA512

    81b373b3ac1e7811b1fe3f92a818699dd599a14cc00d7520c44e1737308b089a30cc391ed46862570a6d99b7828824e317475635b450467fadeb22eac1ebd0d8

  • SSDEEP

    12288:QMrwy90Y7yEq9svNkd/sL0rDidfcLT1qR:wyv2ylEsLg08+

Malware Config

Extracted

Family

redline

Botnet

dariy

C2

217.196.96.101:4132

Attributes
  • auth_value

    2f34aa0d1cb1023a826825b68ebedcc8

Targets

    • Target

      33e4a4b7324d07b7822898341f1ec228e203752bd76fa02d875f8c3b594fc44d

    • Size

      479KB

    • MD5

      2f6a263f0ec86f2b68a6b076e2bf9aa7

    • SHA1

      8a725c5f5c9f663b8dcc47261b81fe5a8f1b522d

    • SHA256

      33e4a4b7324d07b7822898341f1ec228e203752bd76fa02d875f8c3b594fc44d

    • SHA512

      81b373b3ac1e7811b1fe3f92a818699dd599a14cc00d7520c44e1737308b089a30cc391ed46862570a6d99b7828824e317475635b450467fadeb22eac1ebd0d8

    • SSDEEP

      12288:QMrwy90Y7yEq9svNkd/sL0rDidfcLT1qR:wyv2ylEsLg08+

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks