General

  • Target

    90287863d982d89116c88a41cb4bde81268b20b5dc2fb98115bdb7d91ef5db16

  • Size

    433KB

  • Sample

    241111-hjfsesvdpq

  • MD5

    023305d451c5d9533a122f1c99572e06

  • SHA1

    c456301295b5340c5b1da5236ea6b683cdbd74cd

  • SHA256

    90287863d982d89116c88a41cb4bde81268b20b5dc2fb98115bdb7d91ef5db16

  • SHA512

    2228b72d28ec5fba1e8812c2ff3e6f3ba75a4f73fe61491f3843b77afa88dfb0af63c48a5d34df0af7f379d83f021d86df77fc35ae120299a78d2204fb2dc7e5

  • SSDEEP

    12288:KMr5y90978bm8q4pif/DdRm19HgnHkXK0ZfO:Ty/mX7Dd0XAEaR

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      90287863d982d89116c88a41cb4bde81268b20b5dc2fb98115bdb7d91ef5db16

    • Size

      433KB

    • MD5

      023305d451c5d9533a122f1c99572e06

    • SHA1

      c456301295b5340c5b1da5236ea6b683cdbd74cd

    • SHA256

      90287863d982d89116c88a41cb4bde81268b20b5dc2fb98115bdb7d91ef5db16

    • SHA512

      2228b72d28ec5fba1e8812c2ff3e6f3ba75a4f73fe61491f3843b77afa88dfb0af63c48a5d34df0af7f379d83f021d86df77fc35ae120299a78d2204fb2dc7e5

    • SSDEEP

      12288:KMr5y90978bm8q4pif/DdRm19HgnHkXK0ZfO:Ty/mX7Dd0XAEaR

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks