General

  • Target

    8deaebb17f63b741a0b8e7a7da66851e6a270602e7e04e6622b2f319022893bb

  • Size

    476KB

  • Sample

    241111-cy8tvs1cqe

  • MD5

    17931acb123dc292a576deb1d01abb22

  • SHA1

    6699e74e3095f9b7cd43c23f190f4ca0226bbb29

  • SHA256

    8deaebb17f63b741a0b8e7a7da66851e6a270602e7e04e6622b2f319022893bb

  • SHA512

    8add2cbca5f6be464e6d35422ff30a3662b09064a4d62b7a94c190cc28851bf084e9d7e46623ab3ced0aafd697a33fb6d0626ae8f9a305c07d8343628d646643

  • SSDEEP

    12288:vMrCy90NqiA//uj5Kr/0p5d7JaIU3eLT72jvM70:tyyq7/GI0dsI5P72jvMA

Malware Config

Extracted

Family

redline

Botnet

fuka

C2

193.233.20.11:4131

Attributes
  • auth_value

    90eef520554ef188793d77ecc34217bf

Targets

    • Target

      8deaebb17f63b741a0b8e7a7da66851e6a270602e7e04e6622b2f319022893bb

    • Size

      476KB

    • MD5

      17931acb123dc292a576deb1d01abb22

    • SHA1

      6699e74e3095f9b7cd43c23f190f4ca0226bbb29

    • SHA256

      8deaebb17f63b741a0b8e7a7da66851e6a270602e7e04e6622b2f319022893bb

    • SHA512

      8add2cbca5f6be464e6d35422ff30a3662b09064a4d62b7a94c190cc28851bf084e9d7e46623ab3ced0aafd697a33fb6d0626ae8f9a305c07d8343628d646643

    • SSDEEP

      12288:vMrCy90NqiA//uj5Kr/0p5d7JaIU3eLT72jvM70:tyyq7/GI0dsI5P72jvMA

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks