Overview

overview

10

Static

static

8

a911862b8e...6b.exe

windows7_x64

10

a911862b8e...6b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a911862b8e009e674d018aaff16a326b.exe

  • Size

    595KB

  • Sample

    201228-chzjej26ws

  • MD5

    a911862b8e009e674d018aaff16a326b

  • SHA1

    03537444d8d5fee6c3a86cd5ee86a33cba1deeca

  • SHA256

    add432dca76d9ae5e7883d7fccba10211cbf0a6b2f694af0edc37a679739f375

  • SHA512

    903e7d5299d2c84f0a2cf2eeec77f48f0aaf0f0bb4947cddddca1667c0721b2ccb38c36573c125ef37f5bb33b9ab6003030fe2606db647d39c8bbab3ee090b02

Score
10/10
redlineinfostealerupx

Malware Config

Targets

    • Target

      a911862b8e009e674d018aaff16a326b.exe

    • Size

      595KB

    • MD5

      a911862b8e009e674d018aaff16a326b

    • SHA1

      03537444d8d5fee6c3a86cd5ee86a33cba1deeca

    • SHA256

      add432dca76d9ae5e7883d7fccba10211cbf0a6b2f694af0edc37a679739f375

    • SHA512

      903e7d5299d2c84f0a2cf2eeec77f48f0aaf0f0bb4947cddddca1667c0721b2ccb38c36573c125ef37f5bb33b9ab6003030fe2606db647d39c8bbab3ee090b02

    Score
    10/10
    redlineinfostealerupx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks