General

  • Target

    7c4b4985e7317ddb984a1ab357665a69e62771d47b9892461b3c31024e908a9a

  • Size

    424KB

  • Sample

    241111-c4xc1s1dqb

  • MD5

    f19faf4c791e91348e97363f84ce37c4

  • SHA1

    317e26898a702e0698728be961ed5e79585ee8d8

  • SHA256

    7c4b4985e7317ddb984a1ab357665a69e62771d47b9892461b3c31024e908a9a

  • SHA512

    d29c7aa6e54ab74a4a9786e1cb1fffc1b99e17bdf89bfbd16229564473ed194b60d8d3d0de7c42c8754b9381119319922b474b5abced287bf097b63a9f2c3d0d

  • SSDEEP

    12288:LMrDy90CBdaNvs59YKqmow0wTBEHmPSWR+ClcC:YyPBgNUUKqs8GPSKh

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes
  • auth_value

    f88f86755a528d4b25f6f3628c460965

Targets

    • Target

      7c4b4985e7317ddb984a1ab357665a69e62771d47b9892461b3c31024e908a9a

    • Size

      424KB

    • MD5

      f19faf4c791e91348e97363f84ce37c4

    • SHA1

      317e26898a702e0698728be961ed5e79585ee8d8

    • SHA256

      7c4b4985e7317ddb984a1ab357665a69e62771d47b9892461b3c31024e908a9a

    • SHA512

      d29c7aa6e54ab74a4a9786e1cb1fffc1b99e17bdf89bfbd16229564473ed194b60d8d3d0de7c42c8754b9381119319922b474b5abced287bf097b63a9f2c3d0d

    • SSDEEP

      12288:LMrDy90CBdaNvs59YKqmow0wTBEHmPSWR+ClcC:YyPBgNUUKqs8GPSKh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks