redline

General

Target
FE30749E0A05991421373D09B35D63F1E267C8B1DE97850E9AAB4433834049A6.exe
Size 373KB
Sample240724-3gfd4atdnm
SHA256 9bc2f72646fcc040a0c11d469f353931f3d6eb606f8fa60bdcbd0fa091e59968
MD5 c2bbbc6bb9408f1811a956ae26572f62
SHA1 aba71a8c8738a382b3acc454a8ae70a794d760b7
SHA512 911611ca9e77c8ed99823c5d35d85d9bc664c2bd64dbd2cc036cae41b9d9745a82536e120d4a24b963f5cd3b1948ad01304c01228d39497230f53c9d40072f04
SSDEEP 6144:/O6Vlr33sH4azVqKRh+z9GGqX0MY3NguxZdnH/MJcRW5LOYom:/hlr33sH4elT1XU9gunREoR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

50n

C2

193.106.191.123:34450

Attributes

auth_value
d61a9ba1568b3b8e34c959aa0f254969

Targets

- Target
  FE30749E0A05991421373D09B35D63F1E267C8B1DE97850E9AAB4433834049A6.exe
- Size 373KB
- SHA256 9bc2f72646fcc040a0c11d469f353931f3d6eb606f8fa60bdcbd0fa091e59968
- MD5 c2bbbc6bb9408f1811a956ae26572f62
- SHA1 aba71a8c8738a382b3acc454a8ae70a794d760b7
- SHA512 911611ca9e77c8ed99823c5d35d85d9bc664c2bd64dbd2cc036cae41b9d9745a82536e120d4a24b963f5cd3b1948ad01304c01228d39497230f53c9d40072f04
- SSDEEP 6144:/O6Vlr33sH4azVqKRh+z9GGqX0MY3NguxZdnH/MJcRW5LOYom:/hlr33sH4elT1XU9gunREoR
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline 50n aspackv2 discovery infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2