Overview

overview

10

Static

static

88f930ac85...70.exe

windows7_x64

10

88f930ac85...70.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88f930ac85e040f29d454a01302b5270.exe

  • Size

    170KB

  • Sample

    210724-mrj16c9hsj

  • MD5

    88f930ac85e040f29d454a01302b5270

  • SHA1

    237a116a2861efc8662f68828e1a7c2d34cb8047

  • SHA256

    7a07416a0737540a9f0049d6c1094c4986e90d46561ed583f597ca4f01a3eaed

  • SHA512

    0813ea76d3d78604cb27832a47f1f94f20d4ae1114af35777c9aa5058789ab80e18a5fbe699bc89b689ef00c6c169f98d2c1ea17be27cd83c53e690fde27e209

Score
10/10
redlineagilenetinfostealer

Malware Config

Extracted

Family

redline

C2

185.248.101.142:54217

Targets

    • Target

      88f930ac85e040f29d454a01302b5270.exe

    • Size

      170KB

    • MD5

      88f930ac85e040f29d454a01302b5270

    • SHA1

      237a116a2861efc8662f68828e1a7c2d34cb8047

    • SHA256

      7a07416a0737540a9f0049d6c1094c4986e90d46561ed583f597ca4f01a3eaed

    • SHA512

      0813ea76d3d78604cb27832a47f1f94f20d4ae1114af35777c9aa5058789ab80e18a5fbe699bc89b689ef00c6c169f98d2c1ea17be27cd83c53e690fde27e209

    Score
    10/10
    redlineagilenetinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks