General

  • Target

    f31ea0abc3939a194e14a8d46a42abd0645654a7a1b16b7e100ebc09d8f5f9fe

  • Size

    477KB

  • Sample

    241111-gp398sxpen

  • MD5

    e313a9c7cb4cf965624df27aa2315951

  • SHA1

    ec312c831400d64f2d6edc04343a5284e234a210

  • SHA256

    f31ea0abc3939a194e14a8d46a42abd0645654a7a1b16b7e100ebc09d8f5f9fe

  • SHA512

    88ce45e22cdbc332438fe78376c9dc05789f42ca15281c39c4c660864c1802e8134fa401eee16b9121e77d998fd15b191c87a65e07ce4e3c8e25419312d145e8

  • SSDEEP

    12288:WMrgy90BHKhJk6ebdkYQ6VILLI1b3AaWFhYn:ey8HKs6KBMUyjYn

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      f31ea0abc3939a194e14a8d46a42abd0645654a7a1b16b7e100ebc09d8f5f9fe

    • Size

      477KB

    • MD5

      e313a9c7cb4cf965624df27aa2315951

    • SHA1

      ec312c831400d64f2d6edc04343a5284e234a210

    • SHA256

      f31ea0abc3939a194e14a8d46a42abd0645654a7a1b16b7e100ebc09d8f5f9fe

    • SHA512

      88ce45e22cdbc332438fe78376c9dc05789f42ca15281c39c4c660864c1802e8134fa401eee16b9121e77d998fd15b191c87a65e07ce4e3c8e25419312d145e8

    • SSDEEP

      12288:WMrgy90BHKhJk6ebdkYQ6VILLI1b3AaWFhYn:ey8HKs6KBMUyjYn

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks