Overview

overview

10

Static

static

8

89488162f0...f6.exe

windows7_x64

10

89488162f0...f6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    89488162f046f9382ee2ef48127f07f6.exe

  • Size

    593KB

  • Sample

    201228-ljkwm7kcge

  • MD5

    89488162f046f9382ee2ef48127f07f6

  • SHA1

    0855dab4c9297af28185e56d70ad56c34fa0dc7c

  • SHA256

    db0de14458d1ec81a22be0f0393feee5885a668a78e88713162097255ad85c23

  • SHA512

    441cfe52a4b8f53f8a64cb2faf36c65588aee7050492377beca2f22a0d914a195c366995d5a51b60dd01619c8b9f0beb5f77289e7d70832e1dc78b6dc0567a40

Score
10/10
redlineinfostealerupx

Malware Config

Targets

    • Target

      89488162f046f9382ee2ef48127f07f6.exe

    • Size

      593KB

    • MD5

      89488162f046f9382ee2ef48127f07f6

    • SHA1

      0855dab4c9297af28185e56d70ad56c34fa0dc7c

    • SHA256

      db0de14458d1ec81a22be0f0393feee5885a668a78e88713162097255ad85c23

    • SHA512

      441cfe52a4b8f53f8a64cb2faf36c65588aee7050492377beca2f22a0d914a195c366995d5a51b60dd01619c8b9f0beb5f77289e7d70832e1dc78b6dc0567a40

    Score
    10/10
    redlineinfostealerupx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks