General

  • Target

    8ce8f3b0d45935219f2e3753011ae75e2277699dd8ad7fbba598592c56af3d95

  • Size

    441KB

  • Sample

    241111-kkqecsxbka

  • MD5

    dddd3ed7687febc8fa427a3c489d2866

  • SHA1

    78a7d56242c43746d32e9d3a073dd810101280ba

  • SHA256

    8ce8f3b0d45935219f2e3753011ae75e2277699dd8ad7fbba598592c56af3d95

  • SHA512

    dce521abe9ee6296812ea76a81da559aba782d13795d660cc5e80137be3b7bbb7c76a8d423bd24772ec2c15cb35188c9fbd895c2976960cd76d915653014ed59

  • SSDEEP

    12288:fMroy90SfxfEASjtv3p+2wj25s5hBYQaqLe:byJxfEJojIeYQaqa

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      8ce8f3b0d45935219f2e3753011ae75e2277699dd8ad7fbba598592c56af3d95

    • Size

      441KB

    • MD5

      dddd3ed7687febc8fa427a3c489d2866

    • SHA1

      78a7d56242c43746d32e9d3a073dd810101280ba

    • SHA256

      8ce8f3b0d45935219f2e3753011ae75e2277699dd8ad7fbba598592c56af3d95

    • SHA512

      dce521abe9ee6296812ea76a81da559aba782d13795d660cc5e80137be3b7bbb7c76a8d423bd24772ec2c15cb35188c9fbd895c2976960cd76d915653014ed59

    • SSDEEP

      12288:fMroy90SfxfEASjtv3p+2wj25s5hBYQaqLe:byJxfEJojIeYQaqa

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks