redline | 059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9

Analysis

Target

f88b6b23fc39e0e445172415bcb4d293.exe
Size

252KB
MD5

f88b6b23fc39e0e445172415bcb4d293
SHA1

13199416888bbb2c7b6c50310848645f8ac12db6
SHA256

059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9
SHA512

64a5b2f83f368875b70e4eaf6b1ea9ea21dedbf15942e4de9f843de3f7350c6c17f847a87da523686c2bb86a1a5bac6999c3e68c2dce58d09b0f910626266ba4

Score

10^/10

Family

redline

Botnet

SomeBody

185.215.113.29:36224

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1268-58-0x0000000002130000-0x000000000214C000-memory.dmp	family_redline
behavioral1/memory/1268-59-0x0000000002150000-0x000000000216B000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\f88b6b23fc39e0e445172415bcb4d293.exe
"C:\Users\Admin\AppData\Local\Temp\f88b6b23fc39e0e445172415bcb4d293.exe"
1⤵
PID:1268

memory/1268-56-0x0000000000250000-0x0000000000280000-memory.dmp

Filesize
192KB

Download
memory/1268-55-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/1268-57-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1268-58-0x0000000002130000-0x000000000214C000-memory.dmp

Filesize
112KB

Download
memory/1268-59-0x0000000002150000-0x000000000216B000-memory.dmp

Filesize
108KB

Download
memory/1268-62-0x00000000048A3000-0x00000000048A4000-memory.dmp

Filesize
4KB

Download
memory/1268-61-0x00000000048A2000-0x00000000048A3000-memory.dmp

Filesize
4KB

Download
memory/1268-60-0x00000000048A1000-0x00000000048A2000-memory.dmp

Filesize
4KB

Download
memory/1268-63-0x00000000048A4000-0x00000000048A6000-memory.dmp

Filesize
8KB

Download