General

  • Target

    82434e3324789c5d0e6f7cc857f16f12e104b11aca82418d4a9d540b4ba5b095

  • Size

    480KB

  • Sample

    241111-d6hs3s1mht

  • MD5

    2f4fc088849dfe2f536ee6c2f0edfd0e

  • SHA1

    7bba216fcdc08f1cc6a0bccc5d22b7256b853441

  • SHA256

    82434e3324789c5d0e6f7cc857f16f12e104b11aca82418d4a9d540b4ba5b095

  • SHA512

    39b9c64e7861a6003a54a4eda675937cb4ca76e9b7b6c7505ebb342066cfbc926d8e917c1a043a82f3dbd625f17c4aea343f6d81e1169217889ce10435d386b7

  • SSDEEP

    6144:KFy+bnr+Dp0yN90QEF/Yqk/Uy9pdxMRqN+simbIiII2UsxofCif62FVLMd3/zNqN:nMrLy90W/Uy9pHLHDITU/frN+dLW

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      82434e3324789c5d0e6f7cc857f16f12e104b11aca82418d4a9d540b4ba5b095

    • Size

      480KB

    • MD5

      2f4fc088849dfe2f536ee6c2f0edfd0e

    • SHA1

      7bba216fcdc08f1cc6a0bccc5d22b7256b853441

    • SHA256

      82434e3324789c5d0e6f7cc857f16f12e104b11aca82418d4a9d540b4ba5b095

    • SHA512

      39b9c64e7861a6003a54a4eda675937cb4ca76e9b7b6c7505ebb342066cfbc926d8e917c1a043a82f3dbd625f17c4aea343f6d81e1169217889ce10435d386b7

    • SSDEEP

      6144:KFy+bnr+Dp0yN90QEF/Yqk/Uy9pdxMRqN+simbIiII2UsxofCif62FVLMd3/zNqN:nMrLy90W/Uy9pHLHDITU/frN+dLW

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks