General
Target

a35219fe6193aeef80d635355b36acb8.exe

Size

591KB

Sample

210518-7p2mkkbmh2

Score
10/10
MD5

a35219fe6193aeef80d635355b36acb8

SHA1

8939a982a71466ddb9cf55ffef8461afc9035694

SHA256

b9c886eb7a2ac9a654c0bf3639c98125b14f5ae64cf26d36a26edbdb09e4ec3f

SHA512

755a56f2dc66a1361d20d22253a70fa13c3d3a3a7bcccb25ef68e1028657f3acc5cfb14c88ea71d23c33f841ef146a9e9290d014a61b98c4d2c77f0528495115

Malware Config

Extracted

Family

redline

Botnet

TOOL

C2

45.140.146.214:20498

Targets
Target

a35219fe6193aeef80d635355b36acb8.exe

MD5

a35219fe6193aeef80d635355b36acb8

Filesize

591KB

Score
10/10
SHA1

8939a982a71466ddb9cf55ffef8461afc9035694

SHA256

b9c886eb7a2ac9a654c0bf3639c98125b14f5ae64cf26d36a26edbdb09e4ec3f

SHA512

755a56f2dc66a1361d20d22253a70fa13c3d3a3a7bcccb25ef68e1028657f3acc5cfb14c88ea71d23c33f841ef146a9e9290d014a61b98c4d2c77f0528495115

Tags

Signatures

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    Tags

  • RedLine Payload

  • Obfuscated with Agile.Net obfuscator

    Description

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    Tags

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          Score
                          N/A

                          behavioral1

                          Score
                          10/10

                          behavioral2

                          Score
                          10/10