Overview

overview

10

Static

static

Software.exe

windows7-x64

10

Software.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Program.rar

  • Size

    1.7MB

  • Sample

    221105-ar8jeacce9

  • MD5

    15600ab0ce12f7c77fcd36a40627e1e6

  • SHA1

    2921c253de6a8aa7fd0fe65170022badd18f7f32

  • SHA256

    c7495ceea97f4627d459eb81c80f434152d7a2119024e5aa9346aa349a056965

  • SHA512

    fee19f36d9bae461ed038b4b9e836c387c1e3bdbee546f8097ccde6680aee70f3793c3c2162f917c42fcd1cd7faf86d1746c7fd74a646c19b325d49a278a5e1e

  • SSDEEP

    49152:hhrWPqlAQqiO8BciV3nPaqZdkzpiU0fX+qs9:h4L2ciQqZdkzp6s9

Score
10/10
redlinemillionnnnninfostealer

Malware Config

Extracted

Family

redline

Botnet

MILLIONNNNN

C2

45.15.156.8:33890

Attributes
  • auth_value

    df555a41f94d3a3c8aa81c8abf7afa18

Targets

    • Target

      Software.exe

    • Size

      2.4MB

    • MD5

      36ccd3aa014e7534fe820c062225da57

    • SHA1

      29afb477bb48158a1aec283474ea44a5f5847f5d

    • SHA256

      45bc0425ccda58bc870a60c170f17ba4d6eb2b10a4123bcaa6892ebae1668f9e

    • SHA512

      191bce931fbf0cf80304c8cb97ff324018efe6f7935c34339a5e55b55dbb18e59bcecc5ec27b1861dca5e6a662c0f061be852fe1b56d51815cb40828f11a0c8e

    • SSDEEP

      24576:S/UGWRHY1YIXKMaWMbExQqNnylF+eaqbWiuouZuaPZRLMnWEl3RuQ55313Z:S/z9O+XqbWiDuEaPZRWl3X

    Score
    10/10
    redlinemillionnnnninfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks