General

  • Target

    59244f317d545e0f9a0440b489eed9779e6cfc8e67e5c345651f5634e53bb663N.exe

  • Size

    440KB

  • Sample

    241113-bgw83atjb1

  • MD5

    4790fc7052b9a22fdb85c5f123af22d0

  • SHA1

    25ba9e4ffc909bf79353dad14a85c3935fbcaed8

  • SHA256

    59244f317d545e0f9a0440b489eed9779e6cfc8e67e5c345651f5634e53bb663

  • SHA512

    0b97d7e962df3687972d0f9ab4b1c614bdac681635ca9b77da8879427f17392d38be26591bad779c1daf8ab958c50f62e61ec2c3830591060c774617bc6fde74

  • SSDEEP

    12288:iMruy90dhbDlc3gEd9bcCUfmU6CwWmjvOjX:0y0hFc3gwpUOHYImjX

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      59244f317d545e0f9a0440b489eed9779e6cfc8e67e5c345651f5634e53bb663N.exe

    • Size

      440KB

    • MD5

      4790fc7052b9a22fdb85c5f123af22d0

    • SHA1

      25ba9e4ffc909bf79353dad14a85c3935fbcaed8

    • SHA256

      59244f317d545e0f9a0440b489eed9779e6cfc8e67e5c345651f5634e53bb663

    • SHA512

      0b97d7e962df3687972d0f9ab4b1c614bdac681635ca9b77da8879427f17392d38be26591bad779c1daf8ab958c50f62e61ec2c3830591060c774617bc6fde74

    • SSDEEP

      12288:iMruy90dhbDlc3gEd9bcCUfmU6CwWmjvOjX:0y0hFc3gwpUOHYImjX

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks