Overview

overview

10

Static

static

919c0b25ff...63.exe

windows7_x64

10

919c0b25ff...63.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    919c0b25ff9a712e05dca28aaeacae63

  • Size

    34KB

  • Sample

    201117-wxmkj4c7hj

  • MD5

    919c0b25ff9a712e05dca28aaeacae63

  • SHA1

    8e8857b01c90465c65df203bbbd531ea1c28e81b

  • SHA256

    3a970dac31010f29159ebe7e7b86c7482095ec5c811782e4aa12eeac66554531

  • SHA512

    8ff095cbd231ad6c6cba93d9ffd46586516f2da9ccf1558c2b76ae85123d6cb0ce268c3894be273822501ef83755d322f859d28f45fdb9ac27927da68389f4fd

Score
10/10
redlineinfostealer

Malware Config

Targets

    • Target

      919c0b25ff9a712e05dca28aaeacae63

    • Size

      34KB

    • MD5

      919c0b25ff9a712e05dca28aaeacae63

    • SHA1

      8e8857b01c90465c65df203bbbd531ea1c28e81b

    • SHA256

      3a970dac31010f29159ebe7e7b86c7482095ec5c811782e4aa12eeac66554531

    • SHA512

      8ff095cbd231ad6c6cba93d9ffd46586516f2da9ccf1558c2b76ae85123d6cb0ce268c3894be273822501ef83755d322f859d28f45fdb9ac27927da68389f4fd

    Score
    10/10
    redlineinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks