General

  • Target

    45bbe98f5d6f300bea50e72b36cec823d76fb8321d843f1564e95e50536dad19

  • Size

    441KB

  • Sample

    241111-l61yna1nal

  • MD5

    aade3da4fdedb660d9760a3bcd6707d2

  • SHA1

    8d7bb827838311730e1e37408516f56599ddc266

  • SHA256

    45bbe98f5d6f300bea50e72b36cec823d76fb8321d843f1564e95e50536dad19

  • SHA512

    a7118dfdc387270c8f05d4fdf7d14247daa88d5ed3b9fb0b7e8675c2e0127bcfd89de46a1b6bdb81f6ca97686b226d46032c86035314ba0e0fcdde39d2b7d25f

  • SSDEEP

    12288:0MrRy90svN7H7EfwY9DU5iSD4FnUlnzhY1U:tyVFH7EfL0p4uVz/

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      45bbe98f5d6f300bea50e72b36cec823d76fb8321d843f1564e95e50536dad19

    • Size

      441KB

    • MD5

      aade3da4fdedb660d9760a3bcd6707d2

    • SHA1

      8d7bb827838311730e1e37408516f56599ddc266

    • SHA256

      45bbe98f5d6f300bea50e72b36cec823d76fb8321d843f1564e95e50536dad19

    • SHA512

      a7118dfdc387270c8f05d4fdf7d14247daa88d5ed3b9fb0b7e8675c2e0127bcfd89de46a1b6bdb81f6ca97686b226d46032c86035314ba0e0fcdde39d2b7d25f

    • SSDEEP

      12288:0MrRy90svN7H7EfwY9DU5iSD4FnUlnzhY1U:tyVFH7EfL0p4uVz/

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks