General

  • Target

    c5498b2b3c0413cd0277e8ab5006f8aa28e0f61bba84dd1e2283a84b827fe5ad

  • Size

    433KB

  • Sample

    241111-cez3lszdqn

  • MD5

    5b8389264e0cf020c9da9aa02e8ea4a3

  • SHA1

    a0f9595dda640ebf0b1f8aa3daebf2dfd332b68d

  • SHA256

    c5498b2b3c0413cd0277e8ab5006f8aa28e0f61bba84dd1e2283a84b827fe5ad

  • SHA512

    538ba80f6477fc8f6e351a625e68e28deb78a31341ae75fa4f58bef6d300921b2287b40fd38cb01783069f29ffa4cc1a4a6505e4b2d530bd6d5f35b3d5e941f8

  • SSDEEP

    12288:eMrty90L78bm8q4pif/DdRm19HgWMtMR:7yZmX7Dd0XA1tG

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      c5498b2b3c0413cd0277e8ab5006f8aa28e0f61bba84dd1e2283a84b827fe5ad

    • Size

      433KB

    • MD5

      5b8389264e0cf020c9da9aa02e8ea4a3

    • SHA1

      a0f9595dda640ebf0b1f8aa3daebf2dfd332b68d

    • SHA256

      c5498b2b3c0413cd0277e8ab5006f8aa28e0f61bba84dd1e2283a84b827fe5ad

    • SHA512

      538ba80f6477fc8f6e351a625e68e28deb78a31341ae75fa4f58bef6d300921b2287b40fd38cb01783069f29ffa4cc1a4a6505e4b2d530bd6d5f35b3d5e941f8

    • SSDEEP

      12288:eMrty90L78bm8q4pif/DdRm19HgWMtMR:7yZmX7Dd0XA1tG

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks