General

  • Target

    3eafaae3df66361bf01b60fda25327dbe57d6391296f74efeb40bee2b9ff459d

  • Size

    1.1MB

  • Sample

    241111-cbpgpszglg

  • MD5

    a1f5537ee7d22b45953c94c54661a89e

  • SHA1

    9a37dc1abe9a148bf8e14fb15f9ea53210d69411

  • SHA256

    3eafaae3df66361bf01b60fda25327dbe57d6391296f74efeb40bee2b9ff459d

  • SHA512

    9ec89055912fb9b94a12d29251da1e9e036df30d434bb88741c614decc957082deb72f2ada3efae1e180f96595c1c3d6a28daf3467bd640f1ea978da8d46f3f4

  • SSDEEP

    24576:pyj/VwoiR0HP+ontrgv+jREc9dsE84LzPTAKxvS/Jx:cj/qlR0v+8trgm+cnLjFS

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      3eafaae3df66361bf01b60fda25327dbe57d6391296f74efeb40bee2b9ff459d

    • Size

      1.1MB

    • MD5

      a1f5537ee7d22b45953c94c54661a89e

    • SHA1

      9a37dc1abe9a148bf8e14fb15f9ea53210d69411

    • SHA256

      3eafaae3df66361bf01b60fda25327dbe57d6391296f74efeb40bee2b9ff459d

    • SHA512

      9ec89055912fb9b94a12d29251da1e9e036df30d434bb88741c614decc957082deb72f2ada3efae1e180f96595c1c3d6a28daf3467bd640f1ea978da8d46f3f4

    • SSDEEP

      24576:pyj/VwoiR0HP+ontrgv+jREc9dsE84LzPTAKxvS/Jx:cj/qlR0v+8trgm+cnLjFS

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks