General

  • Target

    e730b7e1ad1b59d85f2deb5940095cc919b027637c686f4a380b24df34056928

  • Size

    711KB

  • Sample

    241111-cr1vns1bmd

  • MD5

    7df6bbf2df4d7a08addbe34529c28392

  • SHA1

    3761f0c541d124a876601e33316a0674514f372e

  • SHA256

    e730b7e1ad1b59d85f2deb5940095cc919b027637c686f4a380b24df34056928

  • SHA512

    2b67e475a76e48f1f90137bcea791f9e542f8c55972d35e2461fc360388533d3aca7ff05c95c5d119474a8ecea9e86958c017f6a2fb8b8c8299a7195813edbef

  • SSDEEP

    12288:IMrly90fs1917lwSL8AjLM2gAGEB+PdIQfvBMiiIM1O2uRwaIAYnVB5jxDKqziMX:9yF195RfLQAdOI4B+IM1igAYnxjBKgi6

Malware Config

Extracted

Family

redline

Botnet

daris

C2

217.196.96.56:4138

Attributes
  • auth_value

    3491f24ae0250969cd45ce4b3fe77549

Targets

    • Target

      e730b7e1ad1b59d85f2deb5940095cc919b027637c686f4a380b24df34056928

    • Size

      711KB

    • MD5

      7df6bbf2df4d7a08addbe34529c28392

    • SHA1

      3761f0c541d124a876601e33316a0674514f372e

    • SHA256

      e730b7e1ad1b59d85f2deb5940095cc919b027637c686f4a380b24df34056928

    • SHA512

      2b67e475a76e48f1f90137bcea791f9e542f8c55972d35e2461fc360388533d3aca7ff05c95c5d119474a8ecea9e86958c017f6a2fb8b8c8299a7195813edbef

    • SSDEEP

      12288:IMrly90fs1917lwSL8AjLM2gAGEB+PdIQfvBMiiIM1O2uRwaIAYnVB5jxDKqziMX:9yF195RfLQAdOI4B+IM1igAYnxjBKgi6

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks