Overview

overview

10

Static

static

3

eef77f5f93...22.exe

windows7-x64

10

eef77f5f93...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe92a4f11568c22cbfb62b84c094637cffd39b0261a262be5bdf31a5c90a65d6

  • Size

    123KB

  • Sample

    241106-17mvra1nek

  • MD5

    0c62f9ae94805a0b70600dd46027965b

  • SHA1

    a2fc0752a6b6f8f5886fb3c7eeec3e4440269973

  • SHA256

    fe92a4f11568c22cbfb62b84c094637cffd39b0261a262be5bdf31a5c90a65d6

  • SHA512

    bc2fec9801415257b175c7f0bad012a0f44d47dd9cff8438017d1e7307e7c936f61924a739dde5daff63354a56f17711d45e2224a7fd655af3c34ea6b3075d4e

  • SSDEEP

    3072:hIKvMm+dRA9Kb+N/r28anhYVAVzpQ5oJfsGOlI9:hWPjb+XAVzIif7OlI9

Score
10/10
redlinepub2discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub2

C2

89.22.231.25:45245

Attributes
  • auth_value

    ea9464d486a641bb513057e5f63399e1

Targets

    • Target

      eef77f5f93cad5895d93d499ef471e11944cbf455188d7c3550b7445c8067222

    • Size

      285KB

    • MD5

      eb7ebbae9cc7c96b40a739d1a892689d

    • SHA1

      567f31267f43ad62fc5c65fbc75b538a563fe6c0

    • SHA256

      eef77f5f93cad5895d93d499ef471e11944cbf455188d7c3550b7445c8067222

    • SHA512

      70c9aae88838885c2d4b9c88f3dcf088df34f9056dbb3a138595867d37fd04e716acf7bf5539a5be817f064298325c29f4848c279796f334f8425a89bc578044

    • SSDEEP

      6144:PWd9WTYysJfeB7o+rH2aFAIUXt52/aQLjyUGS/l:PWd9WTYtmH1FVU952yQX

    Score
    10/10
    redlinepub2discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks