General

  • Target

    1379fe87cb3ca041da91bbb29502d78038ef1ad3043031992cfb3e58c5a57600.exe

  • Size

    661KB

  • Sample

    241120-fkgp1awmfm

  • MD5

    168ffb57d902e84131e9c6fa58864164

  • SHA1

    8101c55e5349f17a9f16b8c7ba79d18ba6e4953a

  • SHA256

    1379fe87cb3ca041da91bbb29502d78038ef1ad3043031992cfb3e58c5a57600

  • SHA512

    a5932dfae85b0cad87fabf2982db3eae2ef4714cb555028149a0c007e1a76dece3a0e35e2f436eb109586ea8ec0172326573ab1021927fdf6c867b0efa64599b

  • SSDEEP

    12288:7MrDy90yKA2u6MURYyWXmribg7+yo0WwMSbK6oNyXk1gLDNyTiKwp+s:EyouPbg7+ihHog0aZyThxs

Malware Config

Extracted

Family

redline

Botnet

romik

C2

193.233.20.12:4132

Attributes
  • auth_value

    8fb78d2889ba0ca42678b59b884e88ff

Targets

    • Target

      1379fe87cb3ca041da91bbb29502d78038ef1ad3043031992cfb3e58c5a57600.exe

    • Size

      661KB

    • MD5

      168ffb57d902e84131e9c6fa58864164

    • SHA1

      8101c55e5349f17a9f16b8c7ba79d18ba6e4953a

    • SHA256

      1379fe87cb3ca041da91bbb29502d78038ef1ad3043031992cfb3e58c5a57600

    • SHA512

      a5932dfae85b0cad87fabf2982db3eae2ef4714cb555028149a0c007e1a76dece3a0e35e2f436eb109586ea8ec0172326573ab1021927fdf6c867b0efa64599b

    • SSDEEP

      12288:7MrDy90yKA2u6MURYyWXmribg7+yo0WwMSbK6oNyXk1gLDNyTiKwp+s:EyouPbg7+ihHog0aZyThxs

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks