Overview

overview

10

Static

static

3

61188ef3f3...ae.exe

windows7-x64

10

61188ef3f3...ae.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61188ef3f3931219c4823b80905cd3c12bdac0c8bb887c9b9d701f36c986f3ae.bin

  • Size

    781KB

  • Sample

    230507-c5ymgagf4z

  • MD5

    802b0d426592238ff48378f1e7b2f084

  • SHA1

    0df27c7554ffceb70f9778e607caefaa76e67c01

  • SHA256

    61188ef3f3931219c4823b80905cd3c12bdac0c8bb887c9b9d701f36c986f3ae

  • SHA512

    4b8cd56626aff9db7080cfd0ef3e6467bf91d30e54f8402694740b6c0f82fc18b2c2434d13400a73254f8fb7269ae0c8a7948ec1fffb076af03f5a587456c7a7

  • SSDEEP

    24576:YyRIOL3hBKC6Kb9W/zD9YBBHde9sG/jTLfZ:f+s3xpwrRYq7/jHf

Score
10/10
redlinedarkgenainfostealerpersistencestealer

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dark

C2

185.161.248.73:4164

Attributes
  • auth_value

    ae85b01f66afe8770afeed560513fc2d

Targets

    • Target

      61188ef3f3931219c4823b80905cd3c12bdac0c8bb887c9b9d701f36c986f3ae.bin

    • Size

      781KB

    • MD5

      802b0d426592238ff48378f1e7b2f084

    • SHA1

      0df27c7554ffceb70f9778e607caefaa76e67c01

    • SHA256

      61188ef3f3931219c4823b80905cd3c12bdac0c8bb887c9b9d701f36c986f3ae

    • SHA512

      4b8cd56626aff9db7080cfd0ef3e6467bf91d30e54f8402694740b6c0f82fc18b2c2434d13400a73254f8fb7269ae0c8a7948ec1fffb076af03f5a587456c7a7

    • SSDEEP

      24576:YyRIOL3hBKC6Kb9W/zD9YBBHde9sG/jTLfZ:f+s3xpwrRYq7/jHf

    Score
    10/10
    redlinedarkgenainfostealerpersistencestealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks