Overview

overview

10

Static

static

3

44312c2207...7c.exe

windows7-x64

10

44312c2207...7c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d4150170ab9fd9a2fcc7f6f8df226eb6afabdffd9fa1ba45562704c36cdd3cb

  • Size

    119KB

  • Sample

    241104-w494natqe1

  • MD5

    8685ba23bbaca8e94c16aefe40dd7439

  • SHA1

    5114cb266d977c419dd049dd06727477d1c4e67a

  • SHA256

    2d4150170ab9fd9a2fcc7f6f8df226eb6afabdffd9fa1ba45562704c36cdd3cb

  • SHA512

    7b6b92f272ea0b10c1cf9e1753a0873abeb8b998e01caa84886df94f90925c676df6732274efcea19facc04b722da3a4f8803a26c1ebd5e81aaa9ce418cdc01d

  • SSDEEP

    3072:/QBSMwSSPo8hvjczIbgHknmU4nCPxmg7xa+:3b1P1XbAknvPxmg74+

Score
10/10
redlinepub2discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub2

C2

89.22.231.25:45245

Attributes
  • auth_value

    ea9464d486a641bb513057e5f63399e1

Targets

    • Target

      44312c2207d025bcefca42f8a68330f2841ba8a564356e521d23d9b05450457c

    • Size

      277KB

    • MD5

      21ce10f853d0c3286a9e7b6338224fb7

    • SHA1

      03ab7a1ee153160d81c51343964b9926d2acc781

    • SHA256

      44312c2207d025bcefca42f8a68330f2841ba8a564356e521d23d9b05450457c

    • SHA512

      a60f9ba747b91abe7e0a8eaeb5ca6ee21386777482e108ba15368eee77ef1685b06cbe7d601cddd7122f480a47507c5e38231382f3b4aaaffdc75e59d48d4269

    • SSDEEP

      3072:P3DJ0ADKLyLGAZzIXBVWIMekVAngc13Ba/4m+cBbSeK7lS2B06cpiAAE+8MTxkVn:fd30yLGaaBVSekuCHiRS2Bvu71Me1X

    Score
    10/10
    redlinepub2discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks