redline

General

Target
8A750934CCF173BB5C18B02F0A2993569277B567546F5FA36DDBFB0885CC4CB0.exe
Size 374KB
Sample240724-xal1ea1dnp
SHA256 df35a3307a2a260d02fe2c4bf034c869d1f0cf67e0fcbd84ac0e7f71c138a5eb
MD5 32160481ce1c241b9229265bc4e07c74
SHA1 e3d52948cbac4cd4180586f5023a15449cdfe742
SHA512 c536bb45a0f6d07d065d5f073b64eb6abee891b4d3622a8247e8c9bdaa5fb8a155d7edc777b7f297f06e1038a0c999a4b57329f6cec5e031e4c03aa92d8d1dbb
SSDEEP 6144:GKE1fQef+DjaIkQi7qggSe1ItW/YaFK+beMWwCtbx+TU6N+6ZJl4o/R:GzfQef+DjaIk/3sjzFK+bDxdhNzPv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

60n

C2

193.106.191.123:34450

Attributes

auth_value
c9bcbc8fac47ba6b7f3012eca29db0dc

Targets

- Target
  8A750934CCF173BB5C18B02F0A2993569277B567546F5FA36DDBFB0885CC4CB0.exe
- Size 374KB
- SHA256 df35a3307a2a260d02fe2c4bf034c869d1f0cf67e0fcbd84ac0e7f71c138a5eb
- MD5 32160481ce1c241b9229265bc4e07c74
- SHA1 e3d52948cbac4cd4180586f5023a15449cdfe742
- SHA512 c536bb45a0f6d07d065d5f073b64eb6abee891b4d3622a8247e8c9bdaa5fb8a155d7edc777b7f297f06e1038a0c999a4b57329f6cec5e031e4c03aa92d8d1dbb
- SSDEEP 6144:GKE1fQef+DjaIkQi7qggSe1ItW/YaFK+beMWwCtbx+TU6N+6ZJl4o/R:GzfQef+DjaIk/3sjzFK+bDxdhNzPv
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline 60n aspackv2 discovery infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2