General

  • Target

    521026402dabb896f318cc07941de8a50ca9625bb2b24b324dff57c0fdd2bc77

  • Size

    1.5MB

  • Sample

    241113-138awszkex

  • MD5

    fda6daba8e865ac24624230dda71df1c

  • SHA1

    a86711dda19c0a43146ad9ee281fbcae56651a1f

  • SHA256

    521026402dabb896f318cc07941de8a50ca9625bb2b24b324dff57c0fdd2bc77

  • SHA512

    68126f14622b5ca9d1b7f8ea8b87d23e8b7d012c2bc2ef6af370e8f045513a00cfcd8fd2f250504b663f4b0542504da1bd2274d5410c186911f0a90e30a86953

  • SSDEEP

    24576:KyVZb3hePQxZ3vRbtd1JdIDd6BexRukPKtiVM3tq+HkGwYnzShhkB:RVZ78POZ/RNJj4uuG6CbkjUeh

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      521026402dabb896f318cc07941de8a50ca9625bb2b24b324dff57c0fdd2bc77

    • Size

      1.5MB

    • MD5

      fda6daba8e865ac24624230dda71df1c

    • SHA1

      a86711dda19c0a43146ad9ee281fbcae56651a1f

    • SHA256

      521026402dabb896f318cc07941de8a50ca9625bb2b24b324dff57c0fdd2bc77

    • SHA512

      68126f14622b5ca9d1b7f8ea8b87d23e8b7d012c2bc2ef6af370e8f045513a00cfcd8fd2f250504b663f4b0542504da1bd2274d5410c186911f0a90e30a86953

    • SSDEEP

      24576:KyVZb3hePQxZ3vRbtd1JdIDd6BexRukPKtiVM3tq+HkGwYnzShhkB:RVZ78POZ/RNJj4uuG6CbkjUeh

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks