Description
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
General
Target
Size
Sample
a35219fe6193aeef80d635355b36acb8.exe
591KB
210518-7p2mkkbmh2
Score
10/10
MD5
SHA1
SHA256
SHA512
a35219fe6193aeef80d635355b36acb8
8939a982a71466ddb9cf55ffef8461afc9035694
b9c886eb7a2ac9a654c0bf3639c98125b14f5ae64cf26d36a26edbdb09e4ec3f
755a56f2dc66a1361d20d22253a70fa13c3d3a3a7bcccb25ef68e1028657f3acc5cfb14c88ea71d23c33f841ef146a9e9290d014a61b98c4d2c77f0528495115
Malware Config
Extracted
| Family | redline |
| Botnet | TOOL |
| C2 |
45.140.146.214:20498 |
Targets
Target
MD5
Filesize
a35219fe6193aeef80d635355b36acb8.exe
a35219fe6193aeef80d635355b36acb8
591KB
Score
10/10
SHA1
SHA256
SHA512
8939a982a71466ddb9cf55ffef8461afc9035694
b9c886eb7a2ac9a654c0bf3639c98125b14f5ae64cf26d36a26edbdb09e4ec3f
755a56f2dc66a1361d20d22253a70fa13c3d3a3a7bcccb25ef68e1028657f3acc5cfb14c88ea71d23c33f841ef146a9e9290d014a61b98c4d2c77f0528495115
Tags
Signatures
-
RedLine
-
RedLine Payload
-
Obfuscated with Agile.Net obfuscator
Description
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Tags
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10