General

  • Target

    0370286016a793b6b4d3fb647aba2dc7f893e278a37a7c49d45fbddf1faa56d2.exe

  • Size

    843KB

  • Sample

    241119-wjt7pszell

  • MD5

    be3dbdc6a690363172732abc11e0d93c

  • SHA1

    1bbf494ab00fc31d9f06ec0db06d6c7125df589f

  • SHA256

    0370286016a793b6b4d3fb647aba2dc7f893e278a37a7c49d45fbddf1faa56d2

  • SHA512

    475aa239c7c38149f43c1f3438cd4fb3a546ea8906993f26aece41742ea56344fe4942d821462954f1ffdb9daa5542ab581ac645b7942dcfe988ed4f2f5047f3

  • SSDEEP

    24576:PyuVt7U7Fuogx3T3Cab1MKrSY/twKx9L4EE:aQWz2XVVD/0

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      0370286016a793b6b4d3fb647aba2dc7f893e278a37a7c49d45fbddf1faa56d2.exe

    • Size

      843KB

    • MD5

      be3dbdc6a690363172732abc11e0d93c

    • SHA1

      1bbf494ab00fc31d9f06ec0db06d6c7125df589f

    • SHA256

      0370286016a793b6b4d3fb647aba2dc7f893e278a37a7c49d45fbddf1faa56d2

    • SHA512

      475aa239c7c38149f43c1f3438cd4fb3a546ea8906993f26aece41742ea56344fe4942d821462954f1ffdb9daa5542ab581ac645b7942dcfe988ed4f2f5047f3

    • SSDEEP

      24576:PyuVt7U7Fuogx3T3Cab1MKrSY/twKx9L4EE:aQWz2XVVD/0

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks