Overview

overview

10

Static

static

3

baaf32104f...97.exe

windows7-x64

10

baaf32104f...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ea3ab46fb2af4176766b41e60ad1c715244d966ea652c3dff696da1f70a6fc1

  • Size

    120KB

  • Sample

    241110-rd9mzsxney

  • MD5

    d3a0b0130b5665656d4a9ecec6932b10

  • SHA1

    67abbe6dfda252e3bbaa66d1860f56f3f17597fd

  • SHA256

    7ea3ab46fb2af4176766b41e60ad1c715244d966ea652c3dff696da1f70a6fc1

  • SHA512

    9f4c6ddf7850e49679f4dce6c2d176e023413d8c4ed03fb4293394307bf694be6882d9f9811d2f9d609d1f5e4c713a19aaf7cb7d81f38a581e0c83856189f20f

  • SSDEEP

    3072:SZ0fIRrzv9mxQWzknroYfFf4IrIbN5pNP4Vx0gKjnsKU0:TfIrJPWz8oQ+IrIbNJI0bsi

Score
10/10
redlinepub3discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub3

C2

89.22.231.25:45245

Attributes
  • auth_value

    ffd0fd0d5630c2c573c643bde2ed50b3

Targets

    • Target

      baaf32104f474e63a3796052e9c892263fa05f58edd7de8d3bccecac08107997

    • Size

      277KB

    • MD5

      6d08b98ff314f5621f656b8d0a991275

    • SHA1

      4d195676dac73d4df0003cda5b29138be94821b9

    • SHA256

      baaf32104f474e63a3796052e9c892263fa05f58edd7de8d3bccecac08107997

    • SHA512

      a3769a130c27bdd2e9a0e66dae166b0ebcd752da51db4b49a6e87417c60e1cbbb7a841831224ba9ad44452a9a157d96133e8005ca1520843d6d7423e66336dd3

    • SSDEEP

      3072:ePjx0ADKrqLOwZzoXhdWgMeEdAngc136aTm/KMoRvjR9cibZj5UnSuRnHMX:aV3EqLOq6hd6eEmbTKKrRN91bZgWX

    Score
    10/10
    redlinepub3discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks