General

  • Target

    b8f28513fdc04185e27d2bd5d1c2c124a04f808954b44b14fa60b74c2ee24466

  • Size

    1.5MB

  • Sample

    241111-c5rtxstqgn

  • MD5

    609bdac69d09ab48171e4540a41bae8b

  • SHA1

    3af72db0018fc87144951efe5b09d27fb0894970

  • SHA256

    b8f28513fdc04185e27d2bd5d1c2c124a04f808954b44b14fa60b74c2ee24466

  • SHA512

    ba09fa02eaf2d462e397267e068fb8ad35d19e548aefe58f9de285a53787dfbac1e4eb580bb01bbf816004d0685c547f758e55a40f6a07a0de2d3f441c8eee1f

  • SSDEEP

    24576:Fy+t8aBq8D5C9AmF8LFKLwQ7XzcEfxnrhFOC1tftojBkQlKFCBRh6:g0F58T0kBfcEV/1tftod1OCBR

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      b8f28513fdc04185e27d2bd5d1c2c124a04f808954b44b14fa60b74c2ee24466

    • Size

      1.5MB

    • MD5

      609bdac69d09ab48171e4540a41bae8b

    • SHA1

      3af72db0018fc87144951efe5b09d27fb0894970

    • SHA256

      b8f28513fdc04185e27d2bd5d1c2c124a04f808954b44b14fa60b74c2ee24466

    • SHA512

      ba09fa02eaf2d462e397267e068fb8ad35d19e548aefe58f9de285a53787dfbac1e4eb580bb01bbf816004d0685c547f758e55a40f6a07a0de2d3f441c8eee1f

    • SSDEEP

      24576:Fy+t8aBq8D5C9AmF8LFKLwQ7XzcEfxnrhFOC1tftojBkQlKFCBRh6:g0F58T0kBfcEV/1tftod1OCBR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks