Overview

overview

10

Static

static

3

44312c2207...7c.exe

windows7-x64

10

44312c2207...7c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36f31d07f79da900d4f2009a8c663370ca02e2a503fe0d37a1cdf5808d6210d1

  • Size

    119KB

  • Sample

    241110-laqstathpb

  • MD5

    72332768da37447bfccb65cc79cfd08e

  • SHA1

    7bbaa4f733c0f206a8c198e99dd7531165a9d8e5

  • SHA256

    36f31d07f79da900d4f2009a8c663370ca02e2a503fe0d37a1cdf5808d6210d1

  • SHA512

    aaf0ed8fab048a752c89fe2e02967d08253bc6ebb31933b454980c1953335b97a76b5471cf6c342bb526b4882b2612839f865ddee918d30910d7c27600bb3a10

  • SSDEEP

    3072:LQBSMwSSPo8hvjczIbgHknmU4nCPxmg7xa6:Lb1P1XbAknvPxmg746

Score
10/10
redlinepub2discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub2

C2

89.22.231.25:45245

Attributes
  • auth_value

    ea9464d486a641bb513057e5f63399e1

Targets

    • Target

      44312c2207d025bcefca42f8a68330f2841ba8a564356e521d23d9b05450457c

    • Size

      277KB

    • MD5

      21ce10f853d0c3286a9e7b6338224fb7

    • SHA1

      03ab7a1ee153160d81c51343964b9926d2acc781

    • SHA256

      44312c2207d025bcefca42f8a68330f2841ba8a564356e521d23d9b05450457c

    • SHA512

      a60f9ba747b91abe7e0a8eaeb5ca6ee21386777482e108ba15368eee77ef1685b06cbe7d601cddd7122f480a47507c5e38231382f3b4aaaffdc75e59d48d4269

    • SSDEEP

      3072:P3DJ0ADKLyLGAZzIXBVWIMekVAngc13Ba/4m+cBbSeK7lS2B06cpiAAE+8MTxkVn:fd30yLGaaBVSekuCHiRS2Bvu71Me1X

    Score
    10/10
    redlinepub2discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks