Overview

overview

10

Static

static

3

44312c2207...7c.exe

windows7-x64

10

44312c2207...7c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87dab151d1d1154859fda14aafd0569709d1271e5491eb7434eb9e8da1e71bb7

  • Size

    119KB

  • Sample

    241108-l6afps1bkp

  • MD5

    3c6145df4da3a1c2f41e3f20df89cd55

  • SHA1

    c1949b01c812a6393fb4bb1e95fb0dda42693a61

  • SHA256

    87dab151d1d1154859fda14aafd0569709d1271e5491eb7434eb9e8da1e71bb7

  • SHA512

    ee075f6967d2bbe9342abeb4762ee608cb830576d514a7be9e38ef9b4e90a81bb8859d280880701ec9417fd851232788840e54181e7374e1f28e4ad0591f51cf

  • SSDEEP

    3072:9QBSMwSSPo8hvjczIbgHknmU4nCPxmg7xaQ:Fb1P1XbAknvPxmg74Q

Score
10/10
redlinepub2discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub2

C2

89.22.231.25:45245

Attributes
  • auth_value

    ea9464d486a641bb513057e5f63399e1

Targets

    • Target

      44312c2207d025bcefca42f8a68330f2841ba8a564356e521d23d9b05450457c

    • Size

      277KB

    • MD5

      21ce10f853d0c3286a9e7b6338224fb7

    • SHA1

      03ab7a1ee153160d81c51343964b9926d2acc781

    • SHA256

      44312c2207d025bcefca42f8a68330f2841ba8a564356e521d23d9b05450457c

    • SHA512

      a60f9ba747b91abe7e0a8eaeb5ca6ee21386777482e108ba15368eee77ef1685b06cbe7d601cddd7122f480a47507c5e38231382f3b4aaaffdc75e59d48d4269

    • SSDEEP

      3072:P3DJ0ADKLyLGAZzIXBVWIMekVAngc13Ba/4m+cBbSeK7lS2B06cpiAAE+8MTxkVn:fd30yLGaaBVSekuCHiRS2Bvu71Me1X

    Score
    10/10
    redlinepub2discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks