Overview

overview

10

Static

static

3

239c93b0a4...b2.exe

windows7-x64

1

239c93b0a4...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5237a3f0b1db945c1fe3f9ba71e3ff2.bin

  • Size

    188KB

  • Sample

    230628-b5j9eafh96

  • MD5

    de864f604c381975c6037f1c07784a6d

  • SHA1

    e783cb827c25ef60b8e3da1d26986cc8206cc423

  • SHA256

    cc7cf8749904ae86070b62c4ba66f3049f0bb34b873b7b23ce674201c93ab177

  • SHA512

    6e80255748b4050a05bc4a5881ee9b516bb9bd7d9a9978e611ba3d7c85a22a28e6e843f66aafbd552a9a226100c483dfd9e3e98423faf0065e046df9170c82fb

  • SSDEEP

    3072:e4sdgtKAzuFth4A2NI31NxURXZue+tl+khhHmQ5zHw5Kk5Iy3QsUIqFoP2eN+KMy:e4gg48uruA2I3PxURkecl+chn0zj3iIr

Score
10/10
redline1infostealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

dexstat255.xyz:46578

Attributes
  • auth_value

    c4805fc19583231a4c5bb64b0e833716

Targets

    • Target

      239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2.exe

    • Size

      335KB

    • MD5

      b5237a3f0b1db945c1fe3f9ba71e3ff2

    • SHA1

      ba302c3c2490a3b1b04cfbdd76097f2444a54700

    • SHA256

      239c93b0a44ce8723f181a2ec6d17e9fd9516c17241d8f5b2b0212c6d56a9eb2

    • SHA512

      9879c4cd6e995916cbd8cb16f6cb3982b48b0ffc5d01479e2c2f3f73ae46a5129893571f94ded70a0ad61a1340c67ef8214018bbc7e1e17fd5395a4f55fb78a1

    • SSDEEP

      6144:d/sM+uEe4oleWZxrigxyZdXlgdqUh+LoXl4m34fX6Rs+j2exWLsxAFFDwkGklYkv:5sM+uEe30D67j2exWPFxwkiVi

    Score
    10/10
    redline1infostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Blocklisted process makes network request

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks