Overview

overview

10

Static

static

7

redline_stage_2.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    redline_stage_2.exe

  • Size

    3.2MB

  • Sample

    220920-mxjhpacgg4

  • MD5

    cb256a45f5ea76e960224e587bd339bd

  • SHA1

    4861d0ac38f7a3072e2552576aca1ccb4b5a182c

  • SHA256

    6af5a56deb5139e66b9a344c40861a633b32b5cefbb120355bb3f3f207007cbb

  • SHA512

    ebb1d1e951d8660d44e800a2933fbddb0009be148afd25bb4266ea1c7ad576f4d4343da65eef00b63530e7e42c05acdc7360423749e343d55470d590e210b862

  • SSDEEP

    49152:ojXRjNYpHz+x1DruxTDUCzXWnUcvgvNgFmaQhSD+eE02bSiN6lQi67QeklF:KXvYperWnUCzmUc4V0N1nrc74F

Score
10/10
redlinegdagilenetinfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

GD

C2

49.51.90.156:32323

Attributes
  • auth_value

    216b4a613d722869714e5beaeac54def

Targets

    • Target

      redline_stage_2.exe

    • Size

      3.2MB

    • MD5

      cb256a45f5ea76e960224e587bd339bd

    • SHA1

      4861d0ac38f7a3072e2552576aca1ccb4b5a182c

    • SHA256

      6af5a56deb5139e66b9a344c40861a633b32b5cefbb120355bb3f3f207007cbb

    • SHA512

      ebb1d1e951d8660d44e800a2933fbddb0009be148afd25bb4266ea1c7ad576f4d4343da65eef00b63530e7e42c05acdc7360423749e343d55470d590e210b862

    • SSDEEP

      49152:ojXRjNYpHz+x1DruxTDUCzXWnUcvgvNgFmaQhSD+eE02bSiN6lQi67QeklF:KXvYperWnUCzmUc4V0N1nrc74F

    Score
    10/10
    redlinegdagilenetinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks