Overview

overview

10

Static

static

6d8cc03629...8d.exe

windows7_x64

10

6d8cc03629...8d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d8cc0362985a67099da3641ca7d85be0e69a809e0e9a735a88c97917950f58d

  • Size

    766KB

  • Sample

    201130-73d2dx5sfa

  • MD5

    5fc941cada98dda764b01273ed8c1cb7

  • SHA1

    a0cb4240c9c9f789e588565cce4900f1486b10c9

  • SHA256

    6d8cc0362985a67099da3641ca7d85be0e69a809e0e9a735a88c97917950f58d

  • SHA512

    c92eec5d9167c5253142941b7e39271472c56eb64ebdff59897916a9f7e4e67a353b4d70b2dc729800a25616654adbac784fbdfc72195aa9e1c0398ce9e1f8af

Score
10/10
redlineinfostealer

Malware Config

Targets

    • Target

      6d8cc0362985a67099da3641ca7d85be0e69a809e0e9a735a88c97917950f58d

    • Size

      766KB

    • MD5

      5fc941cada98dda764b01273ed8c1cb7

    • SHA1

      a0cb4240c9c9f789e588565cce4900f1486b10c9

    • SHA256

      6d8cc0362985a67099da3641ca7d85be0e69a809e0e9a735a88c97917950f58d

    • SHA512

      c92eec5d9167c5253142941b7e39271472c56eb64ebdff59897916a9f7e4e67a353b4d70b2dc729800a25616654adbac784fbdfc72195aa9e1c0398ce9e1f8af

    Score
    10/10
    redlineinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks