General

  • Target

    1033bfcb5c0d36d48963a929c56141d329a18c31a705bd7aecc5cdc0168156b1

  • Size

    441KB

  • Sample

    241111-k5czrsxblr

  • MD5

    04bb06b7ff1aba108b06e81c24b5ce86

  • SHA1

    e0d24ad83b994aadcaa9b5e29c047a97d18b6c11

  • SHA256

    1033bfcb5c0d36d48963a929c56141d329a18c31a705bd7aecc5cdc0168156b1

  • SHA512

    b179e1c53ad69da1690f810bc52b0a4ba0abf3f96bac2ca10277fa1173cd2c8669eb922dd7b3a24ca3bb76b6a4db7b43a6997b56b1b09340af0a1fcdd57905fc

  • SSDEEP

    12288:xMrky90MfxfEASjtv3p+2wj25s5hBYQaqPD:xyHxfEJojIeYQaqb

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      1033bfcb5c0d36d48963a929c56141d329a18c31a705bd7aecc5cdc0168156b1

    • Size

      441KB

    • MD5

      04bb06b7ff1aba108b06e81c24b5ce86

    • SHA1

      e0d24ad83b994aadcaa9b5e29c047a97d18b6c11

    • SHA256

      1033bfcb5c0d36d48963a929c56141d329a18c31a705bd7aecc5cdc0168156b1

    • SHA512

      b179e1c53ad69da1690f810bc52b0a4ba0abf3f96bac2ca10277fa1173cd2c8669eb922dd7b3a24ca3bb76b6a4db7b43a6997b56b1b09340af0a1fcdd57905fc

    • SSDEEP

      12288:xMrky90MfxfEASjtv3p+2wj25s5hBYQaqPD:xyHxfEJojIeYQaqb

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks