General

  • Target

    4c05541d5310983c5fcb8adc34c601a33becaf45dc6cd24db9d19e81098486a7

  • Size

    439KB

  • Sample

    241111-j9q7hszmaq

  • MD5

    477f6f623d8f03d6b2fb2db886bd3d12

  • SHA1

    ea9ef436f80143dcfc65ab4daf72ca9d3bff04ca

  • SHA256

    4c05541d5310983c5fcb8adc34c601a33becaf45dc6cd24db9d19e81098486a7

  • SHA512

    e4e7145865d9b5fff8b9e7864928d83a33c16c7963beadea99f2d332c68f8c7f146d45359c1239723d59837f13f2ce6cc6a0929ffcf5fa776d841e1da907bca6

  • SSDEEP

    12288:UMrJy90TJNCUA/bU7wJiKNcIWvLbhoXMi:ly+N9Uo7GiKSIWLmF

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      4c05541d5310983c5fcb8adc34c601a33becaf45dc6cd24db9d19e81098486a7

    • Size

      439KB

    • MD5

      477f6f623d8f03d6b2fb2db886bd3d12

    • SHA1

      ea9ef436f80143dcfc65ab4daf72ca9d3bff04ca

    • SHA256

      4c05541d5310983c5fcb8adc34c601a33becaf45dc6cd24db9d19e81098486a7

    • SHA512

      e4e7145865d9b5fff8b9e7864928d83a33c16c7963beadea99f2d332c68f8c7f146d45359c1239723d59837f13f2ce6cc6a0929ffcf5fa776d841e1da907bca6

    • SSDEEP

      12288:UMrJy90TJNCUA/bU7wJiKNcIWvLbhoXMi:ly+N9Uo7GiKSIWLmF

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks