General

  • Target

    98a1333a4a6560b1cd46031cf3db1988a16f5c345795092a1116e9df6602f35c

  • Size

    479KB

  • Sample

    241111-e56n7awnfm

  • MD5

    8a4ae757ab1694f555706deefe1959ae

  • SHA1

    a1f71bed92686b539af5050dc21b6fa234232f57

  • SHA256

    98a1333a4a6560b1cd46031cf3db1988a16f5c345795092a1116e9df6602f35c

  • SHA512

    69b9d188a1e0b1f6b1d51c06548e2fa2a97d7a19a1fc5e524778183ec9fa31e65bc32f48eb95305be9267137913bdccfa4934eb09b3f0a191dc12dcae6255f57

  • SSDEEP

    12288:SMrSy90wtv+viv1HVTCZzcXfnesXsS2EnoznAxB89:cy3tv+arTDGY2Eny68

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      98a1333a4a6560b1cd46031cf3db1988a16f5c345795092a1116e9df6602f35c

    • Size

      479KB

    • MD5

      8a4ae757ab1694f555706deefe1959ae

    • SHA1

      a1f71bed92686b539af5050dc21b6fa234232f57

    • SHA256

      98a1333a4a6560b1cd46031cf3db1988a16f5c345795092a1116e9df6602f35c

    • SHA512

      69b9d188a1e0b1f6b1d51c06548e2fa2a97d7a19a1fc5e524778183ec9fa31e65bc32f48eb95305be9267137913bdccfa4934eb09b3f0a191dc12dcae6255f57

    • SSDEEP

      12288:SMrSy90wtv+viv1HVTCZzcXfnesXsS2EnoznAxB89:cy3tv+arTDGY2Eny68

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks