General

  • Target

    26583f6be79bec8a5732749d492f27045a4f2c3a0eb6613eb2bb737d835ae3ffN.exe

  • Size

    419KB

  • Sample

    241119-mqnttsvarf

  • MD5

    7a114faa1e2932c8cf6b963472abe050

  • SHA1

    6f4cd6776dd8c0338a32fbe2f7c4fcd840972253

  • SHA256

    26583f6be79bec8a5732749d492f27045a4f2c3a0eb6613eb2bb737d835ae3ff

  • SHA512

    484578973f4ee5394cfe7c1162ee1c0a38178f52331a58b729310a975f659206ce2211b4bbee415c3680fb90179738a9cba33c73319d7d0cf23b069d525a7cd9

  • SSDEEP

    12288:3Mr9y90lSBK5eAWyl///vdZOr3PtSpycV7eka4BPllo3Zx5t:mydk5LWS//twPEEe9aCPDwZxf

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes
  • auth_value

    f88f86755a528d4b25f6f3628c460965

Targets

    • Target

      26583f6be79bec8a5732749d492f27045a4f2c3a0eb6613eb2bb737d835ae3ffN.exe

    • Size

      419KB

    • MD5

      7a114faa1e2932c8cf6b963472abe050

    • SHA1

      6f4cd6776dd8c0338a32fbe2f7c4fcd840972253

    • SHA256

      26583f6be79bec8a5732749d492f27045a4f2c3a0eb6613eb2bb737d835ae3ff

    • SHA512

      484578973f4ee5394cfe7c1162ee1c0a38178f52331a58b729310a975f659206ce2211b4bbee415c3680fb90179738a9cba33c73319d7d0cf23b069d525a7cd9

    • SSDEEP

      12288:3Mr9y90lSBK5eAWyl///vdZOr3PtSpycV7eka4BPllo3Zx5t:mydk5LWS//twPEEe9aCPDwZxf

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks