Overview

overview

10

Static

static

3

44312c2207...7c.exe

windows7-x64

10

44312c2207...7c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29cee251903a4f7479e3354888f51b1271066235795ee351c5f0044c667a48f0

  • Size

    119KB

  • Sample

    241110-aytc3awaml

  • MD5

    b4a84db1817256f2c48411cf156976e7

  • SHA1

    46235396743265c9b2974a56f3230a0a35dd0d08

  • SHA256

    29cee251903a4f7479e3354888f51b1271066235795ee351c5f0044c667a48f0

  • SHA512

    8f4d58d5717870095c695863302bcea5cfcd3f9d7be957502e9d2f04ca5c85b37fe7e9b5430cad34ec82b45ce1e32cabf9a4f2f81ca55274b02aa0aa068d1c6b

  • SSDEEP

    3072:9QBSMwSSPo8hvjczIbgHknmU4nCPxmg7xag:Fb1P1XbAknvPxmg74g

Score
10/10
redlinepub2discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub2

C2

89.22.231.25:45245

Attributes
  • auth_value

    ea9464d486a641bb513057e5f63399e1

Targets

    • Target

      44312c2207d025bcefca42f8a68330f2841ba8a564356e521d23d9b05450457c

    • Size

      277KB

    • MD5

      21ce10f853d0c3286a9e7b6338224fb7

    • SHA1

      03ab7a1ee153160d81c51343964b9926d2acc781

    • SHA256

      44312c2207d025bcefca42f8a68330f2841ba8a564356e521d23d9b05450457c

    • SHA512

      a60f9ba747b91abe7e0a8eaeb5ca6ee21386777482e108ba15368eee77ef1685b06cbe7d601cddd7122f480a47507c5e38231382f3b4aaaffdc75e59d48d4269

    • SSDEEP

      3072:P3DJ0ADKLyLGAZzIXBVWIMekVAngc13Ba/4m+cBbSeK7lS2B06cpiAAE+8MTxkVn:fd30yLGaaBVSekuCHiRS2Bvu71Me1X

    Score
    10/10
    redlinepub2discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks