redline | d61d3a2b7baf50caa24b8c3c5078f697fb7a1d293013430c1a547c3a95e2bda3

Analysis

max time kernel
134s
max time network
148s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 05:32

Target

0x00060000000232c2-319.exe
Size

230KB
MD5

ecc49f0f67a6a13a38726e4082a2902b
SHA1

0de0821b14f74f3cdedf993bce4182b6ed083bed
SHA256

d61d3a2b7baf50caa24b8c3c5078f697fb7a1d293013430c1a547c3a95e2bda3
SHA512

b4ace6e551a1647e70811ecbad665a0254e9714a69ec02777af9e544cfb5374d0bbc3c592dafbb72876bb3a017722f8ca574882cacadd81d8b937a5df73e4915
SSDEEP

3072:sgspAnCNgcepupXKLh8DjV7OGt/qasDrTv+mIqd44oKG6g:jOACNgceQpXKLKdr/ODrTmmpd44oK

Score

10^/10

Family

redline

Botnet

gigant

77.91.124.55:19071

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3040-0-0x00000000000F0000-0x000000000012E000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\0x00060000000232c2-319.exe
"C:\Users\Admin\AppData\Local\Temp\0x00060000000232c2-319.exe"
1⤵
PID:3040

memory/3040-0-0x00000000000F0000-0x000000000012E000-memory.dmp

Filesize
248KB

Download
memory/3040-1-0x0000000073CC0000-0x00000000743AE000-memory.dmp

Filesize
6.9MB

Download
memory/3040-2-0x00000000070A0000-0x00000000070E0000-memory.dmp

Filesize
256KB

Download
memory/3040-3-0x0000000073CC0000-0x00000000743AE000-memory.dmp

Filesize
6.9MB

Download
memory/3040-4-0x00000000070A0000-0x00000000070E0000-memory.dmp

Filesize
256KB

Download