Overview

overview

10

Static

static

48f6d5bdf1...21.exe

windows7_x64

10

48f6d5bdf1...21.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48f6d5bdf1a21e63f13ce2784b945c21.exe

  • Size

    529KB

  • Sample

    210219-bq9mg6gjde

  • MD5

    48f6d5bdf1a21e63f13ce2784b945c21

  • SHA1

    4bee0b5343aae9eb3a869a717e7d33e841290eaa

  • SHA256

    fc75e0db35a8db7c56bc4c3e45532fc32293270ea477f891c7b0556f93a74b80

  • SHA512

    72c51112ae6dbe6e2e1bfce59d7f318ce7de6fe3e57d6913d9ea04800f00e20b4bbb6c53112eaa3d67175aa0a3b84b9ee724ff3c2b2c9f9e9183eb971d35e2a6

Score
10/10
redlineinfostealer

Malware Config

Targets

    • Target

      48f6d5bdf1a21e63f13ce2784b945c21.exe

    • Size

      529KB

    • MD5

      48f6d5bdf1a21e63f13ce2784b945c21

    • SHA1

      4bee0b5343aae9eb3a869a717e7d33e841290eaa

    • SHA256

      fc75e0db35a8db7c56bc4c3e45532fc32293270ea477f891c7b0556f93a74b80

    • SHA512

      72c51112ae6dbe6e2e1bfce59d7f318ce7de6fe3e57d6913d9ea04800f00e20b4bbb6c53112eaa3d67175aa0a3b84b9ee724ff3c2b2c9f9e9183eb971d35e2a6

    Score
    10/10
    redlineinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks