General

  • Target

    f0167df84ec489e08f3baf379446fafd6ef8f8de6479f0347bae0a7d0253a6c2

  • Size

    766KB

  • Sample

    241111-ds6b8a1gjr

  • MD5

    76fe6136f5779acde14ba95af0f40086

  • SHA1

    7a36fcc90193eb9b8a25ccc3b73cbc6c7bb26a57

  • SHA256

    f0167df84ec489e08f3baf379446fafd6ef8f8de6479f0347bae0a7d0253a6c2

  • SHA512

    23bf9180aecd22f626ef952798615268b60cf2e47cec81b48ff0b919721628636a4e6e3e3bfc814be08d528215ac6985e4adcf24acab3ad77f369c0be491d9ba

  • SSDEEP

    12288:nMrJy90F0F/Vl8YL8lbm5ge9+v0zUWjWurLUN4acYipBV4hklVlZaAc/Bf+SnnAc:+yNBVl8++xe0vzWjWkQiFb6gTYAcZf+c

Malware Config

Extracted

Family

redline

Botnet

romik

C2

193.233.20.12:4132

Attributes
  • auth_value

    8fb78d2889ba0ca42678b59b884e88ff

Targets

    • Target

      f0167df84ec489e08f3baf379446fafd6ef8f8de6479f0347bae0a7d0253a6c2

    • Size

      766KB

    • MD5

      76fe6136f5779acde14ba95af0f40086

    • SHA1

      7a36fcc90193eb9b8a25ccc3b73cbc6c7bb26a57

    • SHA256

      f0167df84ec489e08f3baf379446fafd6ef8f8de6479f0347bae0a7d0253a6c2

    • SHA512

      23bf9180aecd22f626ef952798615268b60cf2e47cec81b48ff0b919721628636a4e6e3e3bfc814be08d528215ac6985e4adcf24acab3ad77f369c0be491d9ba

    • SSDEEP

      12288:nMrJy90F0F/Vl8YL8lbm5ge9+v0zUWjWurLUN4acYipBV4hklVlZaAc/Bf+SnnAc:+yNBVl8++xe0vzWjWkQiFb6gTYAcZf+c

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks