Overview

overview

10

Static

static

3

baaf32104f...97.exe

windows7-x64

10

baaf32104f...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75131d7111999cbf23ad07be39cd4aa336d1db6a8112d9600b5a6092692f29cb

  • Size

    120KB

  • Sample

    241110-s8gq5asrdn

  • MD5

    6ba666433ff38fe572b6a08d86e7bdb2

  • SHA1

    8384875eac7ccdb90ab908380ad8836d59fd9078

  • SHA256

    75131d7111999cbf23ad07be39cd4aa336d1db6a8112d9600b5a6092692f29cb

  • SHA512

    ee61ec82fb8e22a7c07307aa569198e7d87dcf88243381f980b7e5c0fb35bb81f65e2b115ecc29b3300eb56ed9091aeea894688ef3f6fe82d99901ab21bf4fa0

  • SSDEEP

    3072:VZ0fIRrzv9mxQWzknroYfFf4IrIbN5pNP4Vx0gKjnsKU1:0fIrJPWz8oQ+IrIbNJI0bsH

Score
10/10
redlinepub3discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub3

C2

89.22.231.25:45245

Attributes
  • auth_value

    ffd0fd0d5630c2c573c643bde2ed50b3

Targets

    • Target

      baaf32104f474e63a3796052e9c892263fa05f58edd7de8d3bccecac08107997

    • Size

      277KB

    • MD5

      6d08b98ff314f5621f656b8d0a991275

    • SHA1

      4d195676dac73d4df0003cda5b29138be94821b9

    • SHA256

      baaf32104f474e63a3796052e9c892263fa05f58edd7de8d3bccecac08107997

    • SHA512

      a3769a130c27bdd2e9a0e66dae166b0ebcd752da51db4b49a6e87417c60e1cbbb7a841831224ba9ad44452a9a157d96133e8005ca1520843d6d7423e66336dd3

    • SSDEEP

      3072:ePjx0ADKrqLOwZzoXhdWgMeEdAngc136aTm/KMoRvjR9cibZj5UnSuRnHMX:aV3EqLOq6hd6eEmbTKKrRN91bZgWX

    Score
    10/10
    redlinepub3discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks