General

  • Target

    236f8e9e6a97e81ca91288808c8e3a1c1d2e8b339069a827dfb11049127b80adN

  • Size

    480KB

  • Sample

    241111-tls2ba1drp

  • MD5

    2edbc71d21d01cb33824fceee8f05950

  • SHA1

    24cd51a76608c64ec8cc0f52b1e0960deed0d880

  • SHA256

    236f8e9e6a97e81ca91288808c8e3a1c1d2e8b339069a827dfb11049127b80ad

  • SHA512

    b5f8e6e07d555825576c6d4f3049843932b138d2e20fd4af1f8109e3080940d878811743ab92561104956be1ae1cef3c14947e4b27113b2d83ea511cc7a088d1

  • SSDEEP

    12288:pMrCy90Y0DyLWhxHiOqfNikwBYhxutDCVjj1:Hyx0DySZMIkwHt+Vj1

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      236f8e9e6a97e81ca91288808c8e3a1c1d2e8b339069a827dfb11049127b80adN

    • Size

      480KB

    • MD5

      2edbc71d21d01cb33824fceee8f05950

    • SHA1

      24cd51a76608c64ec8cc0f52b1e0960deed0d880

    • SHA256

      236f8e9e6a97e81ca91288808c8e3a1c1d2e8b339069a827dfb11049127b80ad

    • SHA512

      b5f8e6e07d555825576c6d4f3049843932b138d2e20fd4af1f8109e3080940d878811743ab92561104956be1ae1cef3c14947e4b27113b2d83ea511cc7a088d1

    • SSDEEP

      12288:pMrCy90Y0DyLWhxHiOqfNikwBYhxutDCVjj1:Hyx0DySZMIkwHt+Vj1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks