General

  • Target

    651957bef1fba7d12777d414395850b2acdff9a5bccd45c2504e75e63865ce2b

  • Size

    435KB

  • Sample

    241111-czrlzatpcl

  • MD5

    15ac1d73b362683f259e06e7ed9403bb

  • SHA1

    fa76d25aac7fce25716062afc34dacf6020cfc8d

  • SHA256

    651957bef1fba7d12777d414395850b2acdff9a5bccd45c2504e75e63865ce2b

  • SHA512

    d992ba9bdaa8b17ea33ebcd83f2297055b1c3934b4a638da2f4715d3b0b0e6a176b0251f59024055271a15e89e090ebf618341548e6d9ff007dd3f2c1433d003

  • SSDEEP

    12288:1MrCy90Dz7+yhqiE4DKjtRkJQY0jX03yRO:Lyk2gqnRjtRkJX0Y3yY

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      651957bef1fba7d12777d414395850b2acdff9a5bccd45c2504e75e63865ce2b

    • Size

      435KB

    • MD5

      15ac1d73b362683f259e06e7ed9403bb

    • SHA1

      fa76d25aac7fce25716062afc34dacf6020cfc8d

    • SHA256

      651957bef1fba7d12777d414395850b2acdff9a5bccd45c2504e75e63865ce2b

    • SHA512

      d992ba9bdaa8b17ea33ebcd83f2297055b1c3934b4a638da2f4715d3b0b0e6a176b0251f59024055271a15e89e090ebf618341548e6d9ff007dd3f2c1433d003

    • SSDEEP

      12288:1MrCy90Dz7+yhqiE4DKjtRkJQY0jX03yRO:Lyk2gqnRjtRkJX0Y3yY

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks