redline

General

Target
5673773206126F12F4692E91C084B927357D9CF5FA3D5C312D89C9942B5C90FE.exe
Size 373KB
Sample240724-rxexqa1arp
SHA256 456a62ef0aaa0549e4867c3da9f2413f96f1fa8e77a7262e64d6a16e3d7aa63a
MD5 ed6acec8310511c1e0b08421734a9373
SHA1 fd093d5b3a59fd00ea4465bf112fb4d64fd12f6e
SHA512 79326bf931cb82986f970ad0fe82c775849f031c87dbefef83a9c6c4aec8d19ca36325a6a7d2594b9ae800880a89b842b42c035fb16f08bfd18ec85e3fb1824c
SSDEEP 6144:ZXGAaFsi+XvzP3mqwHHKQkMJ82S+jiAMrH263+KOck8poGQTdGMknUjtHa1oT:Z5Msi+XvzO3HHKQkMJXS/npuVvsoGP0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

50n

C2

193.106.191.123:34450

Attributes

auth_value
d61a9ba1568b3b8e34c959aa0f254969

Targets

- Target
  5673773206126F12F4692E91C084B927357D9CF5FA3D5C312D89C9942B5C90FE.exe
- Size 373KB
- SHA256 456a62ef0aaa0549e4867c3da9f2413f96f1fa8e77a7262e64d6a16e3d7aa63a
- MD5 ed6acec8310511c1e0b08421734a9373
- SHA1 fd093d5b3a59fd00ea4465bf112fb4d64fd12f6e
- SHA512 79326bf931cb82986f970ad0fe82c775849f031c87dbefef83a9c6c4aec8d19ca36325a6a7d2594b9ae800880a89b842b42c035fb16f08bfd18ec85e3fb1824c
- SSDEEP 6144:ZXGAaFsi+XvzP3mqwHHKQkMJ82S+jiAMrH263+KOck8poGQTdGMknUjtHa1oT:Z5Msi+XvzO3HHKQkMJXS/npuVvsoGP0
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline 50n aspackv2 discovery infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2