Overview

overview

10

Static

static

2925b0ded3...f6.exe

windows7_x64

10

2925b0ded3...f6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2925b0ded3481c8d591953f51fc2bdf6.exe

  • Size

    1.6MB

  • Sample

    201214-ysv9g1pzjj

  • MD5

    2925b0ded3481c8d591953f51fc2bdf6

  • SHA1

    c908771ddd4e98d2e529435ed8088278bb0fd8c6

  • SHA256

    cd0877c4520b3696db9393de1565caf3844f26b588244dd4bb38b149f46d3400

  • SHA512

    76c334152fb722b12e6e66a76040fd1a0fcbcb4703d08435cf22d4833352df1d38c3c9ebcc69dcc759baf235c2c5c364cf5789f0b69c93a00ae55081ede5b68b

Score
10/10
redlineinfostealerupx

Malware Config

Targets

    • Target

      2925b0ded3481c8d591953f51fc2bdf6.exe

    • Size

      1.6MB

    • MD5

      2925b0ded3481c8d591953f51fc2bdf6

    • SHA1

      c908771ddd4e98d2e529435ed8088278bb0fd8c6

    • SHA256

      cd0877c4520b3696db9393de1565caf3844f26b588244dd4bb38b149f46d3400

    • SHA512

      76c334152fb722b12e6e66a76040fd1a0fcbcb4703d08435cf22d4833352df1d38c3c9ebcc69dcc759baf235c2c5c364cf5789f0b69c93a00ae55081ede5b68b

    Score
    10/10
    redlineinfostealerupx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks