General

  • Target

    6c5e67ae2a93dea2890cf8f07664e7445706e8d99826ee22782af33c59a9e972

  • Size

    480KB

  • Sample

    241111-bv3b8sspbq

  • MD5

    cfe3ac0e9820fc70a501d6138e96dfa0

  • SHA1

    dde5eb9f11a92152304397e17aa1e5a3d6fee5e2

  • SHA256

    6c5e67ae2a93dea2890cf8f07664e7445706e8d99826ee22782af33c59a9e972

  • SHA512

    5206ab08c08621d265e2480d8781c4a04c3f9a66511a5b7aa309831ed090990be11dc60a78d42043b45ae7f60f60d0ecf95470d444063e642db9534bd94f24bc

  • SSDEEP

    12288:kMrCy901vMAfcyK7tQH82wULhZ72dPHi/:uyw0A67ePsF+

Malware Config

Extracted

Family

redline

Botnet

dona

C2

217.196.96.101:4132

Attributes
  • auth_value

    9fbb198992bbc83a84ab1f21384813e3

Targets

    • Target

      6c5e67ae2a93dea2890cf8f07664e7445706e8d99826ee22782af33c59a9e972

    • Size

      480KB

    • MD5

      cfe3ac0e9820fc70a501d6138e96dfa0

    • SHA1

      dde5eb9f11a92152304397e17aa1e5a3d6fee5e2

    • SHA256

      6c5e67ae2a93dea2890cf8f07664e7445706e8d99826ee22782af33c59a9e972

    • SHA512

      5206ab08c08621d265e2480d8781c4a04c3f9a66511a5b7aa309831ed090990be11dc60a78d42043b45ae7f60f60d0ecf95470d444063e642db9534bd94f24bc

    • SSDEEP

      12288:kMrCy901vMAfcyK7tQH82wULhZ72dPHi/:uyw0A67ePsF+

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks