General

  • Target
    8e053405793e2bda9a6de93379fe5188
  • Size 623KB
  • Sample220325-azmlxaeabl
  • SHA256 feb32b614bc7f38cc0b553b5fee80b7e68ad8ae78df1f1cae4016a5aa1c4677a
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • redline

Botnet
  • mix20.03

C2
  • 185.215.113.17:7700

Attributes
  • auth_value

    97d68809327425ee29120657cb17339b

Targets

    • Target
      8e053405793e2bda9a6de93379fe5188
    • Size 623KB
    • SHA256 feb32b614bc7f38cc0b553b5fee80b7e68ad8ae78df1f1cae4016a5aa1c4677a
    • MD5 SHA1 SHA512
    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

      suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks