Overview

overview

10

Static

static

Document.p...df.scr

windows7-x64

10

Document.p...df.scr

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Document.pdf.rar
  • Size 5.3MB
  • Sample220730-af74haehgq
  • SHA256 824f65eaa8527b7e2000fc874bf7ecc578a2e6585b6ac5e05bb56d3b45fec477
  • MD5 SHA1 SHA512
Score
10/10
redline4infostealerspyware

Malware Config

Extracted

Family

  • redline

Botnet

  • 4

C2

  • 62.204.41.139:25190

Attributes
  • auth_value

    e3f1c684b72f36028881fd28e808729c

Targets

    • Target
      Document.pdf/Document.pdf.scr
    • Size 700.0MB
    • SHA256 50c4600abe6b9a01aa19a65d6525b0507f943271df564bd7e019e3b5ffa98274
    • MD5 SHA1 SHA512
    Score
    10/10
    redline4infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks