Overview

overview

10

Static

static

1

d6ceb78f6e...1b.exe

windows7-x64

10

d6ceb78f6e...1b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ea09c3bc31fa9830c478f6eefc5b5e76e60a7a05c812a407abcb64d6c3ad862

  • Size

    223KB

  • Sample

    241110-z5wjfaylfl

  • MD5

    fc0a86bef93711d5a14654df25fb92c8

  • SHA1

    471b608718d65ac05f97185a818e3b3c10c06494

  • SHA256

    1ea09c3bc31fa9830c478f6eefc5b5e76e60a7a05c812a407abcb64d6c3ad862

  • SHA512

    7b9a72b8247dc4c0c65202b584cd8c48a62622762b3067f9333c83c443b192652d0a518e9913607fca55c324142e5d118e8b56d888224bd23649e80eb4fc7ade

  • SSDEEP

    6144:b4porQiBU+0Z2uEOF2NRhiOta3WV++SN37R:b4urQ8EMufF2fQx6Sr

Score
10/10
redlineinstallab2discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

INSTALLAB2

C2

65.109.128.140:27702

Attributes
  • auth_value

    5e938a230b2dc75cf1ddef19b610ef84

Targets

    • Target

      d6ceb78f6e8263216c727660761a85b2bf8c37c9b6eec5a564c251ec81585d1b.exe

    • Size

      2.7MB

    • MD5

      e9d45eb873b8c5101a61f7027d923cfc

    • SHA1

      841e570b2e9054fe0c3be8369c3ca12e00b6b46f

    • SHA256

      d6ceb78f6e8263216c727660761a85b2bf8c37c9b6eec5a564c251ec81585d1b

    • SHA512

      8cbac6688e6d290f6a412fce4feaf8fd3088ab7ece1b89454e454c4e60300ae6f930fe0157e0dba18db16e315465898232e3c37e3073ce55eb934ab569e183db

    • SSDEEP

      6144:ROYzcbHES+VvHfl/c4Df810g3W/yZEXAWFsCbpCFOh:ROYs+lHfl/cIq3+IENZb

    Score
    10/10
    redlineinstallab2discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks