General

  • Target

    894acd8b3c8107fb68ff3fbf2ac9513643ed74132f08d23c8858548e301e0fcb

  • Size

    479KB

  • Sample

    241111-bzassaynet

  • MD5

    c84429a913f460ead8e3020e7cebed93

  • SHA1

    fa2215f1188a95e2c07e0a971dc482fd39ec42d5

  • SHA256

    894acd8b3c8107fb68ff3fbf2ac9513643ed74132f08d23c8858548e301e0fcb

  • SHA512

    4f38d9e45d03a89b24481f5fc3c165d256309492884c510e67e4e3a61f06f68eca669d314a8402398837c29ee04b08aa0e7f59107889dfb58975fd6d46deac7c

  • SSDEEP

    12288:TMrqy90TeM1d9XVfZy+V9xycz5uMAQyz0BRAYP:FyYBNZZ4czmkRAYP

Malware Config

Extracted

Family

redline

Botnet

divan

C2

217.196.96.102:4132

Attributes
  • auth_value

    b414986bebd7f5a3ec9aee0341b8e769

Targets

    • Target

      894acd8b3c8107fb68ff3fbf2ac9513643ed74132f08d23c8858548e301e0fcb

    • Size

      479KB

    • MD5

      c84429a913f460ead8e3020e7cebed93

    • SHA1

      fa2215f1188a95e2c07e0a971dc482fd39ec42d5

    • SHA256

      894acd8b3c8107fb68ff3fbf2ac9513643ed74132f08d23c8858548e301e0fcb

    • SHA512

      4f38d9e45d03a89b24481f5fc3c165d256309492884c510e67e4e3a61f06f68eca669d314a8402398837c29ee04b08aa0e7f59107889dfb58975fd6d46deac7c

    • SSDEEP

      12288:TMrqy90TeM1d9XVfZy+V9xycz5uMAQyz0BRAYP:FyYBNZZ4czmkRAYP

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks