Overview

overview

10

Static

static

3

7e0a20831f...1c.exe

windows7-x64

10

7e0a20831f...1c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8553442d0b65766a3f898a4d8fda6f473aa2d93763caf6d5abb9716935e62635

  • Size

    160KB

  • Sample

    241106-ynf7raxdlk

  • MD5

    faab13aa1babe96cd5f48c7d2fa1776d

  • SHA1

    e06494e650507a4e3c477f05644367b1b32c1bd9

  • SHA256

    8553442d0b65766a3f898a4d8fda6f473aa2d93763caf6d5abb9716935e62635

  • SHA512

    70cb414ffabddcfc0379badf7d3ae5ba7f42311d449aefeef19bf048ae7b66cb847a3516fd9b4940eacd30ae523283d6c1d1282b826081d40b5e2123d38696a8

  • SSDEEP

    3072:7zO3L1Ey1NuQ1FHzD6bjxRHqu1sahNiVmJu8dNCiKX:PO3LSSn1N/6bjHVfNym08XjKX

Score
10/10
redlinepub2discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub2

C2

89.22.231.25:45245

Attributes
  • auth_value

    ea9464d486a641bb513057e5f63399e1

Targets

    • Target

      7e0a20831fd4412b796b5b4bd2a5c54726df860e8c005b1b8f6b2f14c554fa1c

    • Size

      354KB

    • MD5

      7d458bb417d06c1b0a87fe81acc02346

    • SHA1

      c4e3e6376886626c7b1aa218716fb28dd57a6274

    • SHA256

      7e0a20831fd4412b796b5b4bd2a5c54726df860e8c005b1b8f6b2f14c554fa1c

    • SHA512

      16a3896586909a48e25090eec091a939204e5650f2f9663eb47dbebfd0ca2d6741b6a18d7cabbe13ecf6304404fc1fe52e0b495a9923740d1857fd7984eca5b3

    • SSDEEP

      6144:5/xTAhCCv7DQ5DF19reEAOnac2O5kBXa3ISmcs7SDxmLRl5L:9FAhWb6EJx5icsrb5

    Score
    10/10
    redlinepub2discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks