Overview

overview

10

Static

static

3

Patch.exe

windows7-x64

10

Patch.exe

windows10-2004-x64

10

Patch.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Patch.exe

  • Size

    300.6MB

  • Sample

    240405-g9qjwadg51

  • MD5

    93012a266eff83ebf81f41b696f0afe2

  • SHA1

    450b5561d703e02d7e2e3c8edb5a61cf585c3946

  • SHA256

    ea28eb3e05ef8fe150ca0d876df588189bb1fe887a7980d68030862fc0508732

  • SHA512

    4d268665baf702bbc902a5351a5ad7230d681b9409ede4f379828446ba27efc78c5bd569172dc25c3f6322668b10466a0ec4146047bf68e6d23b094f956da000

  • SSDEEP

    6144:NVeUT4Kbjq06viONri4LuzOG25JDOMpkMQ2SAYUa/qqdhxMht:NYrED6vXNHLuzOG25JtB8A/abM3

Score
10/10
redline1infostealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

65.21.98.68:18721

Attributes
  • auth_value

    6c69d40026f4e6ecde0e32048f7bacd4

Targets

    • Target

      Patch.exe

    • Size

      300.6MB

    • MD5

      93012a266eff83ebf81f41b696f0afe2

    • SHA1

      450b5561d703e02d7e2e3c8edb5a61cf585c3946

    • SHA256

      ea28eb3e05ef8fe150ca0d876df588189bb1fe887a7980d68030862fc0508732

    • SHA512

      4d268665baf702bbc902a5351a5ad7230d681b9409ede4f379828446ba27efc78c5bd569172dc25c3f6322668b10466a0ec4146047bf68e6d23b094f956da000

    • SSDEEP

      6144:NVeUT4Kbjq06viONri4LuzOG25JDOMpkMQ2SAYUa/qqdhxMht:NYrED6vXNHLuzOG25JtB8A/abM3

    Score
    10/10
    redline1infostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks