General

  • Target

    a4c7de237f0963ae7a5cbbf74883a596982c07f8faf99e6ffe1ae0bdc62905d3.exe

  • Size

    308KB

  • Sample

    241121-klen9avmcr

  • MD5

    8c1ce078b966f39071af18d2497fcbbc

  • SHA1

    1ba00d48c94a89c652db274a494d73dc92142f90

  • SHA256

    a4c7de237f0963ae7a5cbbf74883a596982c07f8faf99e6ffe1ae0bdc62905d3

  • SHA512

    54ac8f6bf225f68f957ea5cbc16cf2778aa1229de5c8ea56e1d7384f1aab681a062a4f7ee98748b813d83ba5c2a58edb8593dd685c32deac7531b959c4ab9082

  • SSDEEP

    6144:K2y+bnr+Op0yN90QEBwSAlP3tIyGHy8lhdSklzz:qMrqy90wrxGSerzz

Malware Config

Extracted

Family

redline

Botnet

dumud

C2

217.196.96.101:4132

Attributes
  • auth_value

    3e18d4b90418aa3e78d8822e87c62f5c

Targets

    • Target

      a4c7de237f0963ae7a5cbbf74883a596982c07f8faf99e6ffe1ae0bdc62905d3.exe

    • Size

      308KB

    • MD5

      8c1ce078b966f39071af18d2497fcbbc

    • SHA1

      1ba00d48c94a89c652db274a494d73dc92142f90

    • SHA256

      a4c7de237f0963ae7a5cbbf74883a596982c07f8faf99e6ffe1ae0bdc62905d3

    • SHA512

      54ac8f6bf225f68f957ea5cbc16cf2778aa1229de5c8ea56e1d7384f1aab681a062a4f7ee98748b813d83ba5c2a58edb8593dd685c32deac7531b959c4ab9082

    • SSDEEP

      6144:K2y+bnr+Op0yN90QEBwSAlP3tIyGHy8lhdSklzz:qMrqy90wrxGSerzz

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks