General

  • Target

    85644a9475c7c124a8e4b677432d193ffab0481bb84b83a680d18a4a273c2946N.exe

  • Size

    168KB

  • Sample

    241112-hfgwbawlhx

  • MD5

    aefc57311e0f88eaba767b600110a291

  • SHA1

    075aa99b21f2bd868609823c60221bd3d2fcd8aa

  • SHA256

    062e827ee46d39194a2c86799c53f1304dda2e4a0e0bb86624a1c8bd95c8363f

  • SHA512

    a850560b32724cf666cd195cb519be866e9f51f3b4d5377f84108f4030b8a264b5899dd3f893dce35be8466b68859adb4f5c8c95fabd2bd7478da1afc6fe8cc9

  • SSDEEP

    3072:uJaohQaSe5clFcb0iCKbqVsTQZxTcVL8e8h2r:uJteaSe5clhiVwxTcVL5

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes
  • auth_value

    3d2870537d84a4c6d7aeecd002871c51

Targets

    • Target

      85644a9475c7c124a8e4b677432d193ffab0481bb84b83a680d18a4a273c2946N.exe

    • Size

      168KB

    • MD5

      aefc57311e0f88eaba767b600110a291

    • SHA1

      075aa99b21f2bd868609823c60221bd3d2fcd8aa

    • SHA256

      062e827ee46d39194a2c86799c53f1304dda2e4a0e0bb86624a1c8bd95c8363f

    • SHA512

      a850560b32724cf666cd195cb519be866e9f51f3b4d5377f84108f4030b8a264b5899dd3f893dce35be8466b68859adb4f5c8c95fabd2bd7478da1afc6fe8cc9

    • SSDEEP

      3072:uJaohQaSe5clFcb0iCKbqVsTQZxTcVL8e8h2r:uJteaSe5clhiVwxTcVL5

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

MITRE ATT&CK Enterprise v15

Tasks