General

  • Target

    43ebad7b690eed2164234bd2dcba6646388b446cfa1d33f96eb2df0856be493c

  • Size

    830KB

  • Sample

    230818-3qaj7sgf81

  • MD5

    56eda9d07d67795106a89aef8ec2470b

  • SHA1

    939d7c0fe93e1008d6d05905d04a85665c9c2f92

  • SHA256

    43ebad7b690eed2164234bd2dcba6646388b446cfa1d33f96eb2df0856be493c

  • SHA512

    4bd8788dbd6c8cbdac5655774177f00ed89db5b3e2c7d94a6e464ac3900464c95503bb2c3d36e264cd4197d8b702bcbc078b06502acf9ef52da4779c8ab95950

  • SSDEEP

    12288:tMrNy90BcnxY+BiiSQZ9AuWq7TnvDObjbDE5Ya9eRVp/Jx66Cwv81ZX:4yNNPSQDPWOnvDOb3I599cHrvq

Malware Config

Extracted

Family

redline

Botnet

dugin

C2

77.91.124.73:19071

Attributes
  • auth_value

    7c3e46e091100fd26a6076996d374c28

Targets

    • Target

      43ebad7b690eed2164234bd2dcba6646388b446cfa1d33f96eb2df0856be493c

    • Size

      830KB

    • MD5

      56eda9d07d67795106a89aef8ec2470b

    • SHA1

      939d7c0fe93e1008d6d05905d04a85665c9c2f92

    • SHA256

      43ebad7b690eed2164234bd2dcba6646388b446cfa1d33f96eb2df0856be493c

    • SHA512

      4bd8788dbd6c8cbdac5655774177f00ed89db5b3e2c7d94a6e464ac3900464c95503bb2c3d36e264cd4197d8b702bcbc078b06502acf9ef52da4779c8ab95950

    • SSDEEP

      12288:tMrNy90BcnxY+BiiSQZ9AuWq7TnvDObjbDE5Ya9eRVp/Jx66Cwv81ZX:4yNNPSQDPWOnvDOb3I599cHrvq

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks