General

  • Target

    011c8b7a5f8c6bf211aac0c935a2b232099953cf3d4bcbd1cd81df1950588b83

  • Size

    479KB

  • Sample

    241111-l851dsxgkr

  • MD5

    9a007d54d45ef2ab873bcf0ae83d59ad

  • SHA1

    53ff750d8a2d1412450e34c8137d56112c72ba49

  • SHA256

    011c8b7a5f8c6bf211aac0c935a2b232099953cf3d4bcbd1cd81df1950588b83

  • SHA512

    e8e337b61e6dc2c30b9ea85bd443784e9649d504298f39fddda0cf137e19a977260acd3595cc9ada0f79bdc5b21e62984ecf1f38ca4d94a4550c6513c8961bd0

  • SSDEEP

    12288:8MrWy90R0XJuYxXS8INl79eFs48Oj2ebZst:KyZFtvINyFL8Oj2etM

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      011c8b7a5f8c6bf211aac0c935a2b232099953cf3d4bcbd1cd81df1950588b83

    • Size

      479KB

    • MD5

      9a007d54d45ef2ab873bcf0ae83d59ad

    • SHA1

      53ff750d8a2d1412450e34c8137d56112c72ba49

    • SHA256

      011c8b7a5f8c6bf211aac0c935a2b232099953cf3d4bcbd1cd81df1950588b83

    • SHA512

      e8e337b61e6dc2c30b9ea85bd443784e9649d504298f39fddda0cf137e19a977260acd3595cc9ada0f79bdc5b21e62984ecf1f38ca4d94a4550c6513c8961bd0

    • SSDEEP

      12288:8MrWy90R0XJuYxXS8INl79eFs48Oj2ebZst:KyZFtvINyFL8Oj2etM

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks