General
-
Target
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874
-
Size
1.1MB
-
Sample
240815-2j4n2aygkb
-
MD5
bbe6311c3e2fab459f729dc8cd6e3519
-
SHA1
b71993aafd6627e55657819826c67f64f764c77f
-
SHA256
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874
-
SHA512
33fb4936db966d0f285a48b09700716eadcdc19212c3e234f34dc0e497e55f01f493956aa86de438a3c65ba8e112d6ee1f3cd0ff9aee3cda1f686cc68dc77a47
-
SSDEEP
24576:HzZyi0Kg1ySDKr8TP/4xDVMRy5MxcTCLA8dUtp+FPlDha1edx/M2:H0iTezbe9jp+FPlEoHR
Static task
static1
Behavioral task
behavioral1
Sample
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874.exe
Resource
win10-20240404-en
Malware Config
Extracted
redline
814FA
88.99.151.68:7200
Targets
-
-
Target
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874
-
Size
1.1MB
-
MD5
bbe6311c3e2fab459f729dc8cd6e3519
-
SHA1
b71993aafd6627e55657819826c67f64f764c77f
-
SHA256
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874
-
SHA512
33fb4936db966d0f285a48b09700716eadcdc19212c3e234f34dc0e497e55f01f493956aa86de438a3c65ba8e112d6ee1f3cd0ff9aee3cda1f686cc68dc77a47
-
SSDEEP
24576:HzZyi0Kg1ySDKr8TP/4xDVMRy5MxcTCLA8dUtp+FPlDha1edx/M2:H0iTezbe9jp+FPlEoHR
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1