General

  • Target

    047bdc8aa48e624826ce3c37f46d5cfd087430550475e0de7da7295760acf507

  • Size

    567KB

  • Sample

    241111-fwe1jsxkan

  • MD5

    7fb1371aa6182a2bdfb05c6b4d71d26c

  • SHA1

    aa327de7d52de6a02221afb14e67364d408f50a2

  • SHA256

    047bdc8aa48e624826ce3c37f46d5cfd087430550475e0de7da7295760acf507

  • SHA512

    17b7d5cb17086d0a7a48a748fba0445220a7396816de2d1a92a187fac6b116d81a7c50e73b87c2d81e63bfffc492c051527ae16aa671a6f030357abd565d8cc3

  • SSDEEP

    12288:sMrDy90M6KTlS51b0IRpLcyzFf3tE+Na+jOdRH3/d37zUZjbFrNXiJh:PyfBpMcmtEcpjwHvd37Mhgh

Malware Config

Extracted

Family

redline

Botnet

daris

C2

217.196.96.56:4138

Attributes
  • auth_value

    3491f24ae0250969cd45ce4b3fe77549

Targets

    • Target

      047bdc8aa48e624826ce3c37f46d5cfd087430550475e0de7da7295760acf507

    • Size

      567KB

    • MD5

      7fb1371aa6182a2bdfb05c6b4d71d26c

    • SHA1

      aa327de7d52de6a02221afb14e67364d408f50a2

    • SHA256

      047bdc8aa48e624826ce3c37f46d5cfd087430550475e0de7da7295760acf507

    • SHA512

      17b7d5cb17086d0a7a48a748fba0445220a7396816de2d1a92a187fac6b116d81a7c50e73b87c2d81e63bfffc492c051527ae16aa671a6f030357abd565d8cc3

    • SSDEEP

      12288:sMrDy90M6KTlS51b0IRpLcyzFf3tE+Na+jOdRH3/d37zUZjbFrNXiJh:PyfBpMcmtEcpjwHvd37Mhgh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks