Overview

overview

10

Static

static

3

baaf32104f...97.exe

windows7-x64

10

baaf32104f...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6606a8bcaf5dd71559d8ba1dd6e357a6f4ff4f229ff2a9c8750142aa97fc14f8

  • Size

    120KB

  • Sample

    241111-f5584athnh

  • MD5

    bf8acaa329c4dd99470906bd26970e96

  • SHA1

    ee9e43a683b876aa7a14f6abaa4dd57d558e719f

  • SHA256

    6606a8bcaf5dd71559d8ba1dd6e357a6f4ff4f229ff2a9c8750142aa97fc14f8

  • SHA512

    7074fe8b6a98a059822f0874a972370e7090219e8fec68d8849134851abce29b9a33a9ff8cb07ad3e6e23f4136136b07073ffff8019d48bdd6ad86114e122329

  • SSDEEP

    3072:IZ0fIRrzv9mxQWzknroYfFf4IrIbN5pNP4Vx0gKjnsKUW:BfIrJPWz8oQ+IrIbNJI0bsA

Score
10/10
redlinepub3discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

pub3

C2

89.22.231.25:45245

Attributes
  • auth_value

    ffd0fd0d5630c2c573c643bde2ed50b3

Targets

    • Target

      baaf32104f474e63a3796052e9c892263fa05f58edd7de8d3bccecac08107997

    • Size

      277KB

    • MD5

      6d08b98ff314f5621f656b8d0a991275

    • SHA1

      4d195676dac73d4df0003cda5b29138be94821b9

    • SHA256

      baaf32104f474e63a3796052e9c892263fa05f58edd7de8d3bccecac08107997

    • SHA512

      a3769a130c27bdd2e9a0e66dae166b0ebcd752da51db4b49a6e87417c60e1cbbb7a841831224ba9ad44452a9a157d96133e8005ca1520843d6d7423e66336dd3

    • SSDEEP

      3072:ePjx0ADKrqLOwZzoXhdWgMeEdAngc136aTm/KMoRvjR9cibZj5UnSuRnHMX:aV3EqLOq6hd6eEmbTKKrRN91bZgWX

    Score
    10/10
    redlinepub3discoveryinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks