General

  • Target

    ab3086fdfa1a0f5b2fec611ee1470c345a222ee81d2c1a528c159cf4ca8b880d

  • Size

    832KB

  • Sample

    230819-aey47sgg7w

  • MD5

    454e656e0b9e6c314614b3fbeb97663f

  • SHA1

    030ed3ee8be19c7dc9b72ec476f71c9bf1963691

  • SHA256

    ab3086fdfa1a0f5b2fec611ee1470c345a222ee81d2c1a528c159cf4ca8b880d

  • SHA512

    e1a22d0777a91a749603992af380458ca79b523195cce5ba4046d9f31dd7553ea38ba87dc3af6722c455b80d1926af756b9f01ff696a358b6dc7eefd2ab77849

  • SSDEEP

    24576:hyfx9uqE3KJLx9oCl0X8dUxvRNdOAwlAws:USqz5E5vzWyw

Malware Config

Extracted

Family

redline

Botnet

dugin

C2

77.91.124.73:19071

Attributes
  • auth_value

    7c3e46e091100fd26a6076996d374c28

Targets

    • Target

      ab3086fdfa1a0f5b2fec611ee1470c345a222ee81d2c1a528c159cf4ca8b880d

    • Size

      832KB

    • MD5

      454e656e0b9e6c314614b3fbeb97663f

    • SHA1

      030ed3ee8be19c7dc9b72ec476f71c9bf1963691

    • SHA256

      ab3086fdfa1a0f5b2fec611ee1470c345a222ee81d2c1a528c159cf4ca8b880d

    • SHA512

      e1a22d0777a91a749603992af380458ca79b523195cce5ba4046d9f31dd7553ea38ba87dc3af6722c455b80d1926af756b9f01ff696a358b6dc7eefd2ab77849

    • SSDEEP

      24576:hyfx9uqE3KJLx9oCl0X8dUxvRNdOAwlAws:USqz5E5vzWyw

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks