Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    1.4MB

  • Sample

    230929-3brj6sfb7z

  • MD5

    ecf7cf59bdba10cf0479d3345504f334

  • SHA1

    bf1bacb0057b930aba4c0494ab5e28956f50a8dd

  • SHA256

    a7a22bca755a347a91faa5e15135cb07320bd0b1e73450f1ce4d73dad8fb77ca

  • SHA512

    b27534802862161943e8009e831b90e13286a4a82aed8b0087a765a9114ee62367f35c258ca0941871de9de04591f914d4451e3083f55d6c1afb0d13e153ec04

  • SSDEEP

    24576:zhyzyicBpqoZTg1SnZtq6PwsBVavJHCwDFNcNvgbhn5F9b9f:zzBpqoZTg4tPNA5hnDVR

Score
10/10
redline@oleh_psinfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.4.46:33783

Attributes
  • auth_value

    94ecdfa2eb126d66ce500353b2fa9112

Targets

    • Target

      file

    • Size

      1.4MB

    • MD5

      ecf7cf59bdba10cf0479d3345504f334

    • SHA1

      bf1bacb0057b930aba4c0494ab5e28956f50a8dd

    • SHA256

      a7a22bca755a347a91faa5e15135cb07320bd0b1e73450f1ce4d73dad8fb77ca

    • SHA512

      b27534802862161943e8009e831b90e13286a4a82aed8b0087a765a9114ee62367f35c258ca0941871de9de04591f914d4451e3083f55d6c1afb0d13e153ec04

    • SSDEEP

      24576:zhyzyicBpqoZTg1SnZtq6PwsBVavJHCwDFNcNvgbhn5F9b9f:zzBpqoZTg4tPNA5hnDVR

    Score
    10/10
    redline@oleh_psinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks