General

  • Target

    0e2bb169696c0829ba5d5bec9edf95baadcc90e751d0a0b22ee996c67a935dcb

  • Size

    433KB

  • Sample

    241111-k4rfrszren

  • MD5

    796534089b98e441d063c93d869236bb

  • SHA1

    f1cac1cfd08755a8d188b082c8151982d5a25dbf

  • SHA256

    0e2bb169696c0829ba5d5bec9edf95baadcc90e751d0a0b22ee996c67a935dcb

  • SHA512

    c9492f7bacaf4b26c6b0d2b3e1eaec499067b70315030e8b4e01ea9539b46d2d7fc21fee46311009f2ff158b0019d4f2df64eb1e0d2b65fe85da366c076a920e

  • SSDEEP

    12288:iMrly90y78bm8q4pif/DdRm19HgWMtM0:HyimX7Dd0XA1tj

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      0e2bb169696c0829ba5d5bec9edf95baadcc90e751d0a0b22ee996c67a935dcb

    • Size

      433KB

    • MD5

      796534089b98e441d063c93d869236bb

    • SHA1

      f1cac1cfd08755a8d188b082c8151982d5a25dbf

    • SHA256

      0e2bb169696c0829ba5d5bec9edf95baadcc90e751d0a0b22ee996c67a935dcb

    • SHA512

      c9492f7bacaf4b26c6b0d2b3e1eaec499067b70315030e8b4e01ea9539b46d2d7fc21fee46311009f2ff158b0019d4f2df64eb1e0d2b65fe85da366c076a920e

    • SSDEEP

      12288:iMrly90y78bm8q4pif/DdRm19HgWMtM0:HyimX7Dd0XA1tj

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks