Overview

overview

10

Static

static

3

b237fba75c...d3.exe

windows7-x64

10

b237fba75c...d3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16fc0af17350f2e473171b1309be40c333a567139c1661c095f4048bfa74c607

  • Size

    120KB

  • Sample

    241109-xbg3vazdmd

  • MD5

    371ec1f9b17ed57ce7f927e532030f9d

  • SHA1

    2c7cddb6f73243631a96e2e04915b343fd46eb57

  • SHA256

    16fc0af17350f2e473171b1309be40c333a567139c1661c095f4048bfa74c607

  • SHA512

    ad71db3f44942cc8112f3fddf67fb7a899f0e0011a573c925d3f112a19e1ed6998d7ad21a587605f0b2b600bc44e92fe115ac6a8fffb424b65cfa601511b8962

  • SSDEEP

    3072:SGERkuN9lmd11X9pdwgnh4IRzNNDFP9MLHb0CrBp:skh1X9pdLhxz3lGL70Cz

Score
10/10
redlinepub3discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub3

C2

89.22.231.25:45245

Attributes
  • auth_value

    ffd0fd0d5630c2c573c643bde2ed50b3

Targets

    • Target

      b237fba75c09f1dd82b992841d1bb03ea1ea661df5f8ef4f283964e1225724d3

    • Size

      277KB

    • MD5

      489659bd5dc88ad20f20a0273e322e77

    • SHA1

      60858714d5838d739710d17df909c3a601181238

    • SHA256

      b237fba75c09f1dd82b992841d1bb03ea1ea661df5f8ef4f283964e1225724d3

    • SHA512

      3e0a6dc8656e4bfa8c2f3d00611ae2800f4e7d99794ac57a83119dd812aa32f44a56defd3c5a3c249fe99a428f4e0d23924902f7b9da6ccd50478f052e0b9261

    • SSDEEP

      6144:KN30iL266hFiekerfygYXqo/kNea9qp/POMX:KN3RL2Rruqo/klqpXOMX

    Score
    10/10
    redlinepub3discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks