General

  • Target

    e63890121e5cf5059bde07a00be57cdbfac500d94d6bed8f7a5a6f811111429aN.exe

  • Size

    844KB

  • Sample

    241113-e7b8cswgmq

  • MD5

    d7ad81b85f1900ad342e8c4330d378c0

  • SHA1

    556e41687b259543384e06d3a3e1af9ef1e29efa

  • SHA256

    e63890121e5cf5059bde07a00be57cdbfac500d94d6bed8f7a5a6f811111429a

  • SHA512

    f3710c7028eb22b6d422c048e20019e059ef5520cc99f5d1738e9f64eac86c899bbf4b521f61b6a7ed564d433f79c1364cc983b1acc58c74fbfc5bf231766d7b

  • SSDEEP

    24576:ty2kRd/Ta9wxL5dbvxefrGlfUtqahpuAPw:I2sNzx9dvxefKfER3

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      e63890121e5cf5059bde07a00be57cdbfac500d94d6bed8f7a5a6f811111429aN.exe

    • Size

      844KB

    • MD5

      d7ad81b85f1900ad342e8c4330d378c0

    • SHA1

      556e41687b259543384e06d3a3e1af9ef1e29efa

    • SHA256

      e63890121e5cf5059bde07a00be57cdbfac500d94d6bed8f7a5a6f811111429a

    • SHA512

      f3710c7028eb22b6d422c048e20019e059ef5520cc99f5d1738e9f64eac86c899bbf4b521f61b6a7ed564d433f79c1364cc983b1acc58c74fbfc5bf231766d7b

    • SSDEEP

      24576:ty2kRd/Ta9wxL5dbvxefrGlfUtqahpuAPw:I2sNzx9dvxefKfER3

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks