redline

General

Target
55282E8B63997F62AF3DD4B9D40CACB30A72D8DB1597D3F53057839CF7335750.exe
Size 374KB
Sample240724-rtkc2ateqa
SHA256 343d64201895c63577cd19542df2465a53786c78c40adf533f1b48ff2c1ede33
MD5 3aeabf97fc5c13d409ce2992820838fd
SHA1 5aad801f2b6a58f125f95464c06c3671047388e8
SHA512 08697a62647165108628c7e7f41daa81bfc374d75726422643c49bf1424e037e4d3d4cf5b2e4e6042b504ffb34a3b9cc60c2d60b01bc33889821de0ab8d290ba
SSDEEP 6144:/gQ7GmYm49gWTlqFbcohS44It0RyC1T+0nZMRBCmA3UlR7Omgc39b2RRoO:/DGmYm49giC9JFF0ZMT/f7tb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

50n

C2

193.106.191.123:34450

Attributes

auth_value
d61a9ba1568b3b8e34c959aa0f254969

Targets

- Target
  55282E8B63997F62AF3DD4B9D40CACB30A72D8DB1597D3F53057839CF7335750.exe
- Size 374KB
- SHA256 343d64201895c63577cd19542df2465a53786c78c40adf533f1b48ff2c1ede33
- MD5 3aeabf97fc5c13d409ce2992820838fd
- SHA1 5aad801f2b6a58f125f95464c06c3671047388e8
- SHA512 08697a62647165108628c7e7f41daa81bfc374d75726422643c49bf1424e037e4d3d4cf5b2e4e6042b504ffb34a3b9cc60c2d60b01bc33889821de0ab8d290ba
- SSDEEP 6144:/gQ7GmYm49gWTlqFbcohS44It0RyC1T+0nZMRBCmA3UlR7Omgc39b2RRoO:/DGmYm49giC9JFF0ZMT/f7tb
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline 50n aspackv2 discovery infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2