General

  • Target

    f1349914eb5eadc128544b7b4a236ff1bfe263bb6f93e67d8f86277fcbdba170

  • Size

    477KB

  • Sample

    241111-cnhvpatlfn

  • MD5

    dd06c78b48a3d866a33468a501546f26

  • SHA1

    a61a0b427c0d680279cfb6f6d3fc83e354cc2272

  • SHA256

    f1349914eb5eadc128544b7b4a236ff1bfe263bb6f93e67d8f86277fcbdba170

  • SHA512

    bfb6e57627d37a91580613d27eaa2039fe611f643d812defa324b45e9e6e04d23ede9b77d51ed7898f4381a14229675c7bba1347a917930d53019084ed1d11a8

  • SSDEEP

    12288:5Mr3y90moKimSg5FnA7h01NwoRSIqH1x+lic:WyOKfSkF2hgNwjVxfc

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      f1349914eb5eadc128544b7b4a236ff1bfe263bb6f93e67d8f86277fcbdba170

    • Size

      477KB

    • MD5

      dd06c78b48a3d866a33468a501546f26

    • SHA1

      a61a0b427c0d680279cfb6f6d3fc83e354cc2272

    • SHA256

      f1349914eb5eadc128544b7b4a236ff1bfe263bb6f93e67d8f86277fcbdba170

    • SHA512

      bfb6e57627d37a91580613d27eaa2039fe611f643d812defa324b45e9e6e04d23ede9b77d51ed7898f4381a14229675c7bba1347a917930d53019084ed1d11a8

    • SSDEEP

      12288:5Mr3y90moKimSg5FnA7h01NwoRSIqH1x+lic:WyOKfSkF2hgNwjVxfc

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks