General

  • Target

    f182e5d1edb2e24f8399c34507783b6210c4f9e966e2b4933d238a80a6b0e7b9

  • Size

    567KB

  • Sample

    241111-hh7jrayken

  • MD5

    ada250967008987740013507c21d63ec

  • SHA1

    cc1d0c4be68627b020d2f1eff827f3c5c1e1a544

  • SHA256

    f182e5d1edb2e24f8399c34507783b6210c4f9e966e2b4933d238a80a6b0e7b9

  • SHA512

    9982bcd2c718c702674dabdefccfc2531c8516a037f68aba0f761883c1778e7871c98476af3cbc8194b7605e8bc86e94bedf2df0cfde361bb2f915c1e93a1088

  • SSDEEP

    12288:SMrZy90qIHYqBPW68IizIPkv7jB22oXdUVbumz/0:zy04AJizi+7loXyQmb0

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Targets

    • Target

      f182e5d1edb2e24f8399c34507783b6210c4f9e966e2b4933d238a80a6b0e7b9

    • Size

      567KB

    • MD5

      ada250967008987740013507c21d63ec

    • SHA1

      cc1d0c4be68627b020d2f1eff827f3c5c1e1a544

    • SHA256

      f182e5d1edb2e24f8399c34507783b6210c4f9e966e2b4933d238a80a6b0e7b9

    • SHA512

      9982bcd2c718c702674dabdefccfc2531c8516a037f68aba0f761883c1778e7871c98476af3cbc8194b7605e8bc86e94bedf2df0cfde361bb2f915c1e93a1088

    • SSDEEP

      12288:SMrZy90qIHYqBPW68IizIPkv7jB22oXdUVbumz/0:zy04AJizi+7loXyQmb0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks