Overview

overview

10

Static

static

dd06232c86...12.exe

windows7-x64

10

dd06232c86...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df78d30c9b01313df869cfe857b14f13.bin

  • Size

    197KB

  • Sample

    230117-jxctcsge7v

  • MD5

    061e05688019ac7e0c92eeaeca7bc647

  • SHA1

    0c5d795a8637925e8aff78269e163f396df9b320

  • SHA256

    283184611778bb124d7db1f3a96114c3a12ce4ef6dfed6c941ae053f03889193

  • SHA512

    ce409d85516d9cbdab2ccc05085368e20a6f877c242fc765b79b9bc51fee55bb4e8a5d18972816c7eba2d28ca19fb990dcf297d191b9c1494b39fc89a6b20cf0

  • SSDEEP

    6144:cIdFGUMidKEiVjxE2w73xNT39elQpr3hSR4:cIr+dVZwDxuKxO4

Score
10/10
redlineinstallinfostealer

Malware Config

Extracted

Family

redline

Botnet

Install

C2

159.223.106.156:81

Attributes
  • auth_value

    f9affed97251c08e7a096257ba9edfb2

Targets

    • Target

      dd06232c864c14a9a494b6e023b114e526ea57dcb8366bf9a6248fd68eab2e12.exe

    • Size

      425KB

    • MD5

      df78d30c9b01313df869cfe857b14f13

    • SHA1

      59d6b5b9dca6cd249caa89209bdc781e3da1f050

    • SHA256

      dd06232c864c14a9a494b6e023b114e526ea57dcb8366bf9a6248fd68eab2e12

    • SHA512

      99dc96b6f9683b9973abc493b71c60289102621af0e20e1355b4462212a9ee66bcd6fdfae21f499940da85b6177e61ebdc9b4d2e94debc80e4fac1e068564144

    • SSDEEP

      12288:XuqM5hh3qkzf7rJRd6UI5SnHJ/qnKkgT3:06kXzdDCnKkgL

    Score
    10/10
    redlineinstallinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks