General

  • Target

    a2ed2579771774d3c8623c8b7dfadf1b6bdb173157ba07b2a056b94e8533f022

  • Size

    480KB

  • Sample

    241111-cremfazkey

  • MD5

    f38b7b634a94dcabca500b8d0e1c71c1

  • SHA1

    8a327dd73af2875e274824c0e54359c84cc80367

  • SHA256

    a2ed2579771774d3c8623c8b7dfadf1b6bdb173157ba07b2a056b94e8533f022

  • SHA512

    ccf661019423d2bc2972b8adc3ef164923fbaaf4b8c6483d56722df62c4455e225efeeea229bb53dc8771cded53b4e9263a087ccad0d4b3e100a125433377106

  • SSDEEP

    12288:CMrqy90IUzjS6xZg6963HzdA2dffKCqLhr9qDfZjvK:Myijvxx0zG2d3UHmjy

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      a2ed2579771774d3c8623c8b7dfadf1b6bdb173157ba07b2a056b94e8533f022

    • Size

      480KB

    • MD5

      f38b7b634a94dcabca500b8d0e1c71c1

    • SHA1

      8a327dd73af2875e274824c0e54359c84cc80367

    • SHA256

      a2ed2579771774d3c8623c8b7dfadf1b6bdb173157ba07b2a056b94e8533f022

    • SHA512

      ccf661019423d2bc2972b8adc3ef164923fbaaf4b8c6483d56722df62c4455e225efeeea229bb53dc8771cded53b4e9263a087ccad0d4b3e100a125433377106

    • SSDEEP

      12288:CMrqy90IUzjS6xZg6963HzdA2dffKCqLhr9qDfZjvK:Myijvxx0zG2d3UHmjy

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks