Overview

overview

10

Static

static

3

7e0a20831f...1c.exe

windows7-x64

10

7e0a20831f...1c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c3879c5a9e5a4c2e4703d7607a6fca83a068112384003ea189d18a5ad7d8c98

  • Size

    160KB

  • Sample

    241110-pvb2yawnay

  • MD5

    a9a7eb0fee4ae4c420b9babbac2ab02f

  • SHA1

    8e886f19d76875428de57bbd71e8fcccf7dc916f

  • SHA256

    4c3879c5a9e5a4c2e4703d7607a6fca83a068112384003ea189d18a5ad7d8c98

  • SHA512

    1576e9d666d497544fcb2e5cf9a27325136ad32c2e195d10d655042aac15390285f126a11f32e90215265476b905ff3528619cd1a05d7a87c9c1103d0b126dd5

  • SSDEEP

    3072:wzO3L1Ey1NuQ1FHzD6bjxRHqu1sahNiVmJu8dNCiKY:6O3LSSn1N/6bjHVfNym08XjKY

Score
10/10
redlinepub2discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub2

C2

89.22.231.25:45245

Attributes
  • auth_value

    ea9464d486a641bb513057e5f63399e1

Targets

    • Target

      7e0a20831fd4412b796b5b4bd2a5c54726df860e8c005b1b8f6b2f14c554fa1c

    • Size

      354KB

    • MD5

      7d458bb417d06c1b0a87fe81acc02346

    • SHA1

      c4e3e6376886626c7b1aa218716fb28dd57a6274

    • SHA256

      7e0a20831fd4412b796b5b4bd2a5c54726df860e8c005b1b8f6b2f14c554fa1c

    • SHA512

      16a3896586909a48e25090eec091a939204e5650f2f9663eb47dbebfd0ca2d6741b6a18d7cabbe13ecf6304404fc1fe52e0b495a9923740d1857fd7984eca5b3

    • SSDEEP

      6144:5/xTAhCCv7DQ5DF19reEAOnac2O5kBXa3ISmcs7SDxmLRl5L:9FAhWb6EJx5icsrb5

    Score
    10/10
    redlinepub2discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks