redline

General

Target
xaf0b37401819e4be02ba64beae0673eb371ce475b9a24e28a1c7592409692ac2.exe
Size 1.3MB
Sample260402-s55zjsbs2w
SHA256 af0b37401819e4be02ba64beae0673eb371ce475b9a24e28a1c7592409692ac2
MD5 1faf03df84241be722e157f0aa7a78f3
SHA1 eaec50689322fab7141d269b813ec0aad67f2588
SHA512 fa2cbba6c49f64feec7ac59215b7c879b0f0034feed741a4bc6db2ef04ab2e94626802e5e3204978138cb9eae6ef7a2eca7488ef2cc31f0648e44e6598492e67
SSDEEP 12288:IDDF2BjT6XYNn5Bx4ecMEkRP4MwEcGnq48ycer5+nZoIA1YaL8i08er5+nt:IDDF2VT6XYNjA5kRlfqvywjAVn
TLSH
T140550757E7814AE8E75D04375F558110D62EF2216A0F27667AAC120CCF5B38B8FA9E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

redline 1 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

107.182.129.73:21733

Attributes

auth_value
3a5bb0917495b4312d052a0b8977d2bb

Targets

- Target
  xaf0b37401819e4be02ba64beae0673eb371ce475b9a24e28a1c7592409692ac2.exe
- Size 1.3MB
- SHA256 af0b37401819e4be02ba64beae0673eb371ce475b9a24e28a1c7592409692ac2
- MD5 1faf03df84241be722e157f0aa7a78f3
- SHA1 eaec50689322fab7141d269b813ec0aad67f2588
- SHA512 fa2cbba6c49f64feec7ac59215b7c879b0f0034feed741a4bc6db2ef04ab2e94626802e5e3204978138cb9eae6ef7a2eca7488ef2cc31f0648e44e6598492e67
- SSDEEP 12288:IDDF2BjT6XYNn5Bx4ecMEkRP4MwEcGnq48ycer5+nZoIA1YaL8i08er5+nt:IDDF2VT6XYNjA5kRlfqvywjAVn
- TLSH
  T140550757E7814AE8E75D04375F558110D62EF2216A0F27667AAC120CCF5B38B8FA9E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

1 discovery redline infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

Redline family

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2