Overview

overview

10

Static

static

8

9cf85e1e2d...2a.exe

windows7_x64

10

9cf85e1e2d...2a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cf85e1e2de960124dd87efe8dd0e72a.exe

  • Size

    595KB

  • Sample

    201228-nqh2smzf2s

  • MD5

    9cf85e1e2de960124dd87efe8dd0e72a

  • SHA1

    ea2d4379e3042fb6bd4271b35faf71c6c720f4ff

  • SHA256

    0ecd4a0cbb6f891a4f527d9df3a12fc717c946556922e3ab49ad866fcd26a15a

  • SHA512

    bc6a368fef8c1d5d90ba83f51cede7553d703d4b80a6aa82592c8385c2f7392f2c28ab3cd3afc69d96b86e2ff736f2f8a4607fb7128f87013d6501252b7d3a57

Score
10/10
redlineinfostealerupx

Malware Config

Targets

    • Target

      9cf85e1e2de960124dd87efe8dd0e72a.exe

    • Size

      595KB

    • MD5

      9cf85e1e2de960124dd87efe8dd0e72a

    • SHA1

      ea2d4379e3042fb6bd4271b35faf71c6c720f4ff

    • SHA256

      0ecd4a0cbb6f891a4f527d9df3a12fc717c946556922e3ab49ad866fcd26a15a

    • SHA512

      bc6a368fef8c1d5d90ba83f51cede7553d703d4b80a6aa82592c8385c2f7392f2c28ab3cd3afc69d96b86e2ff736f2f8a4607fb7128f87013d6501252b7d3a57

    Score
    10/10
    redlineinfostealerupx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks