Overview

overview

10

Static

static

64ae1f3793...8c.exe

windows7-x64

10

64ae1f3793...8c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8603557912.zip

  • Size

    90KB

  • Sample

    221221-1smlfadd93

  • MD5

    df46de6f1be62bdfa2243a0f487926c8

  • SHA1

    cb44a41757b7867cb8c6baad6c41e06bdc82584e

  • SHA256

    80062a2c4d26ad08db5754e7c380325279d7e8e89695516e20dbf688a9d81d23

  • SHA512

    bc5c80a509b6e9d24de51c2846fb15a34735562b7c4e2e28bf228b15c20528bcc24c35ac072a2f0d9f890e2af8d9b78ea5dffe26911017b9e7a3cd4095097746

  • SSDEEP

    1536:VVnpjlEAKP8nL+hdg9OBlDQS6u9zessSBi37bO7/+RsrRQVXgHnk1gNUuaO33lb6:ZldbL+IQ3DQS64zyS/YASKHn+gVaoVW

Score
10/10
redline1474623994_99infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

1474623994_99

C2

maroccowin.top:3306

maroccowin.top:28786
Attributes
  • auth_value

    dc9cea2484b65da8bd62583527966114

Targets

    • Target

      64ae1f37936eeec41ce48b140ff2d4800c99448dd0fa890269eac362be0e478c

    • Size

      119KB

    • MD5

      382c6fcf72d2e1328ea56f8e7ac17221

    • SHA1

      140dbad1dac64f9245011afb001caf3e2a255aea

    • SHA256

      64ae1f37936eeec41ce48b140ff2d4800c99448dd0fa890269eac362be0e478c

    • SHA512

      dc56be235677959d6395f90896e88a4eff9222acbbce550ac6a171dff1fbc1b614327a965e3abc40c3f2840d9dec49283d6b71d42b8501b0976565890217f34b

    • SSDEEP

      1536:fS24cISk+2GlV12JrNKAC5rSW7sM/yExKGvS/VMcYzthOij0u2p9/0jAcFqgDKXE:fhMXc71CNRGmwzdguO9/QPBK+yQesOO

    Score
    10/10
    redline1474623994_99infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks