General

  • Target

    54e30c7fcd79c174946aad10ae659df7707e006e68441edab0a777f262938753

  • Size

    442KB

  • Sample

    241111-lsr4laxgra

  • MD5

    3517873f9731e15428e40bd14a8edd64

  • SHA1

    d2ed4cf3b6f4fef7fbb42ba5385b563ad7b4216f

  • SHA256

    54e30c7fcd79c174946aad10ae659df7707e006e68441edab0a777f262938753

  • SHA512

    9064cc73d219a7cd6479f4138f2a04e53e0f773a72911ee06907dceeec7f68d9c09b798b3845c45f785368a103684be93e9da52e0e72d9243b201c0078f95966

  • SSDEEP

    6144:KAy+bnr+rp0yN90QEMBEyWzP8Hao4s+9V6odP5B/d34Rbs949p64q14xswB:oMr3y90u2yQIao4r6opPiRs94S4q1bG

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      54e30c7fcd79c174946aad10ae659df7707e006e68441edab0a777f262938753

    • Size

      442KB

    • MD5

      3517873f9731e15428e40bd14a8edd64

    • SHA1

      d2ed4cf3b6f4fef7fbb42ba5385b563ad7b4216f

    • SHA256

      54e30c7fcd79c174946aad10ae659df7707e006e68441edab0a777f262938753

    • SHA512

      9064cc73d219a7cd6479f4138f2a04e53e0f773a72911ee06907dceeec7f68d9c09b798b3845c45f785368a103684be93e9da52e0e72d9243b201c0078f95966

    • SSDEEP

      6144:KAy+bnr+rp0yN90QEMBEyWzP8Hao4s+9V6odP5B/d34Rbs949p64q14xswB:oMr3y90u2yQIao4r6opPiRs94S4q1bG

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks