redline | b6ab14a7bb5911d999522a21833acad0ecb5638c31d3d94b305f6b60fefb0c10

Sharing

Copy URL Twitter E-mail

General

Target
hwid-spoofer_softradar-com.zip
Size 6.2MB
Sample260630-xsen2sf14s
SHA256 b6ab14a7bb5911d999522a21833acad0ecb5638c31d3d94b305f6b60fefb0c10
MD5 e49e93285aa09a10ffac2e3362d8e926
SHA1 d5c2d50e58bacba6e8cb165f29d6c096a268cb7b
SHA512 10a11bee7df6b19bcccf5d7755f0e2d8a038c519a349ffbc3b40d82a9c0e317e6d988e88d2f949de02b4fe4acd139aab7b89e75318837367ec3d9bc4f8af2549
SSDEEP 98304:7HS33KqECZTwqOiqaO8pgElCZuSMEv90Zp+TaU4bg8o1srgMmzZ5l8shyWDYuWZr:7QBI8pghwSMEp8bg8qc5m5+shWL+45
TLSH
T127663301EF2963D5F907AAF54EFE8370DA705111FA8D9A0749A420C146BBEBD4F2E0B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

redline

45.15.157.131:36457

Attributes

auth_value
9848b9d66e2e3ff4033fb5f6013c451b

Targets

- Target
  Launcher/Loader.exe
- Size 11.0MB
- SHA256 d2f3273710b161fc4edcc1e53bde7afbb33b3fc205b2fb46909dfdc15ed401e6
- MD5 2cc4733559210cd29bff5c0b62cd69a1
- SHA1 505c3230bf99cd6f54863d9fcc65ad6e4bf65754
- SHA512 c41a5b12e62650230c975805fce78949e4128381d87d6a74e5a41f775a2abcf38d765e6b0df7b9af64de6b164f8773a47c34a6ed514f685d8bb22809f278f6ca
- SSDEEP 6144:vDUUoz6DCGbAR/VeDC1tAOcAC0Oep6TeobhtfPurBiI:v1ozaC+UjPvxMJurBiI
- TLSH
  T13AC69D347899D432C8EE87371590996157BB7C301A475EEB23E35B2E1BD8EE11BE340A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  Launcher/brokeradaptor.dll
- Size 135KB
- SHA256 4d725b105705260065093273cc93b5db7f57afbe05140125fba0856fc46ec1b9
- MD5 acb20911248011efec85b6a86a63f76a
- SHA1 e8fb7ea1b5d6ef8dfd3a637456909b0a72008825
- SHA512 a4f2b9b502f481ba6a559f896a232521bc111c1d24d4307b5f96edb98cb108f7ef490bca1d2ea60654aec58a4dc9edda1b3645baa99eb08a9997842f1b7c5098
- SSDEEP 3072:Zms85B/6AXcctyvm6MAjUN+nmpLyG1GPA:C5V9M3MA4QmNyGwo
- TLSH
  T119D33A123A16C177D49E53B4782DBB6E92696968CF7002C777D89F6D0D340E32E32A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  Launcher/irmfmodulewin32.dll
- Size 5.7MB
- SHA256 2a1ceca155e85ad7430a5fc100b9fd5b79873e61ed13a2123b8287c27b9579a1
- MD5 c048c29dd017beda7f54607f9e416353
- SHA1 e0dba3316c85acd9662629f2c7e391dc7846275f
- SHA512 c4bb6cfecd58759a556071db1034e34ae77bbece70176360d782d5fa27e83f1284cbb05cd1a96a76827361894313844b7d12d8539f4021993ad0350cbcc4a71a
- SSDEEP 98304:Mpmkl7uAEuvs0UFD5VyU66URkLC8Ct81Eae1JqI3YL8SFlWC2nCArWQY14XJcvwz:wl7rEuXUlBikLC8Cy1Eae1JqI3YL8Spq
- TLSH
  T1F7563A32B70DC52BE45D42F6792C5A974448BA7A07A148C3F7806F9A34F60E36636F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Launcher/platforms/bdfilters.dll
- Size 4.1MB
- SHA256 9cbc29696ad2d582e251bf9c4be5cce618753fa43551d2474e1ae5cc5e1245e5
- MD5 ed730387fdcd684b756601b863c47417
- SHA1 c49ed6d0d46facf4ceaeb21f5d6bfdf9e3587fde
- SHA512 e32df727799d33922c6e92f94a7bdb0bc2772d6a6636d15e285d94d3ae4661062e5bc89ec3546b76ec853398f88d972f461327ef687f89093acf1096560d5c3f
- SSDEEP 98304:Xl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KChvvvveo:XuqYuQxqYfHYosUiJoviVKvvvvJ
- TLSH
  T10B167DC3E6FF52E0D4551874203FB92BA6346B0A810CE6A2F1D56F1AFC377825AA7345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Launcher/platforms/qwindows.dll
- Size 1.4MB
- SHA256 02b794c8b4158c258ad0c3d8ff69ba30bffe244d2239d07122f8bcddf42215ed
- MD5 2d08d996a453c97af0a94cf490015f1f
- SHA1 082ba4e232b53ced8d5672dfcf3e051573049d3b
- SHA512 4102039aa8602b32222456572288f64f09c2a7e9b7eff50f85d2d82c497120a58e39aaeedfade3248787abfca6815478dce8d8a64285f0077a35da317244dc7a
- SSDEEP 24576:F6YD7Po3twR8Git2eZalxSsF1fAPLJEZxB7BA:AYPPo3CRotmlxSsQPLJEA
- TLSH
  T18D658D57A36542A4C2ABC23DC65B8B07D6B1700503319BDF01A98E593F23BE3277EB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Launcher/updater/GUP.exe
- Size 255KB
- SHA256 68fe7a43de6a2ea86da2d13d253c275b37933b5028fcc37ed6ac569849670f90
- MD5 8d71f49badcd98cac17ea51e1dcd2146
- SHA1 450940f91d7965076067503f95d1ee4f4dd8f263
- SHA512 760523b5c742af69f9c1d8a1e75592fa501597e35c8d0c2460dda3b4898d47456aba402ecdd01a2e69d693604d81f74495a72b6de8c5ac45b2bcd33bd2bceee7
- SSDEEP 3072:3CHyZ3ITLh7owHGDDyISAmY6AHmhu1yUyFutxgYo8wEw7UpfjN:SSZ0lVHcn6AHauniie72
- TLSH
  T1A944D638261446E4E4BAD87C2D90B4E070B67533EB87B8FF4E1D3726963419F74A067A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery redline infostealer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Suspicious use of SetThreadContext
behavioral6
- Target
  Launcher/updater/binkw32.dll
- Size 188KB
- SHA256 603d0a96d1f27422f88d78b20ca525975ebe5e0d7667e62b98a3db80766702b4
- MD5 8264b55f8c6ebd2d83e6b9e52af83171
- SHA1 ee336cf75c1b9ebce6a2bc8585e07e187320a0dd
- SHA512 3a478bd8162698d2f91e0cee9712d59ec2d80518387023781c7fd67833637b5ad5527a7da00fd06aa45d8382ffdf3ccfa03c12b0d58f42f0fd2fcf2eada78b5f
- SSDEEP 3072:NpT8HbW3dz25rpyB5IcacnlPvmXUYRMvgfqKRYK/2y68D8bjOK29i/ut4lmH7YWK:wbW3d67yQ1+lPvmXUYU7K/2y68D8bjOP
- TLSH
  T1BA14AE82F4965DB0E8CB1DB6109B3B579A251F05C32942E3EB642F979B61DE10D3A3C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Launcher/updater/eax.dll
- Size 188KB
- SHA256 70c38f00d9fb722bcee85e4de6b30edbe580adefb49925c641978deb01a2601b
- MD5 45604d7da563f65c02a76de2c3c05123
- SHA1 cad1a2b729374f2e2b1496355a6baae9d320e69b
- SHA512 223b6df997e01d23434b831463ad2fda0771cba63fab2d59bc6c8104b58493e84b9ff393fe6ed2bf16cf2e6b86f6cdec99daf7d9640dadb1dcb752f0b9c0e25d
- SSDEEP 3072:J1M+oxRixCadWvJE46E0DajLxIw2cpnE9elqSOgU:jMVxRi8ad4E430DaLxIwnS9
- TLSH
  T160146B71AB4185F0D433D4BA5D9ABB3FC77C690A09E96F8B5B24ED922F11301921E2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Launcher/updater/exfill.dll
- Size 978KB
- SHA256 4709398f9ace28679b710876102319323c368ff9cc4d2d94068d305d75754646
- MD5 ecf18a7ec0029b8c1069a033dd4a6abc
- SHA1 09766f70169dc097daade6ce6e76792d8ae9b42a
- SHA512 ac061866e518aba2b96acfef9c742d8495db3879c8d2d606117f6ef854c3793a4287422d0d0840bfb1d5abc40706d38ac7e2d42b6a582666560c00e1534a32aa
- SSDEEP 12288:rxSlSwO/O9mcJJ4p7h0iWXhCDuvg7nXqgeJN:1fej+KAD4eReJN
- TLSH
  T12825F6153BABF72DFF5A0534F02695E94236E1C7B226FBA94BB4A4782C41B005E146F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Launcher/updater/libcurl.dll
- Size 532KB
- SHA256 79f567797066f6206ea870ffda11cf92612aea0ee3a26582be38ddd0fd51fa53
- MD5 8da7e810e0f12b16fe6087aadda7a69c
- SHA1 e76539074da170bf52a9cc06863ff8cb498c76e6
- SHA512 7d9d40e501c9128cb81af785091aaca60b8b92af57a69f1f498bd810431e3521f9431161f8c3e4061b7e0ba2c3dfc8034e66bc4c05f5e39941623b04d367775d
- SSDEEP 6144:y6NI7/hgoJrPOkFVuW6ZoiPPnk/9AAQIPGBxTShA9ZvT6QKob6LHywHFE1P+wTt4:u/ZhPxVOdk/4IPETvzhHuzE1P+wTt4
- TLSH
  T1B9C48CA9B7B407B9E5A7C138C5538607E6B2B4651350E7CF43A48B7A2F23BE1163B710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Launcher/x86/QtCore4.dll
- Size 2.7MB
- SHA256 bc097cc75e9d0771cedeb46efae5e574d0fb5b9cf22750504f817a3590af0541
- MD5 be3317d66646acc0bcb5dda1198db9b5
- SHA1 bde91229d26afe7861db4522dcfa8e1b6fa68a84
- SHA512 fd6aaf3383dc3e67635c24826a43ee03abc5d6ffd07a9214939f9fa5047eafc8b0d3e0083a3a633dcc80f1c395b66362d1800860c9575bfd4004f18573840978
- SSDEEP 49152:oxbwz+A9MHaJVHOsbbWOWXzzULQoAnqagHWL1hp0UnxGJsv6tWKFdu9ChTTLyvLm:4bwz+n6JVHNbb1WDnvgHWL1hp0UnxGJ/
- TLSH
  T13AD56C15EE4B50B3DCBB4E70D03FB27E4A92AD119030999FC64D6D09DA376A0B91F34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Launcher/x86/libgcc_s_dw2-1.dll
- Size 42KB
- SHA256 b35f2a8f4c8f1833f3cdec20739c58e295758ce22021d03d4335043148bd7610
- MD5 c4b4409f186da70fcf2bcc60d5f05489
- SHA1 056663c9fd2851cd64f39d882f6758e7a987bd42
- SHA512 cdcb945a82a0304e4d7cfc9ae9d7e5a5e81d4e3025e982494c87c283f6fac542181e9e1e3028456b9b0b5b6279990cb3e1a50f9df0f6e707c70fa0e23c7a808c
- SSDEEP 768:sZ1l+WCdhTcpKn+CwZoyf/dadEU9mRWtyTN:41l+WGhIKn+CQ7EyW0TN
- TLSH
  T146132A46AEB1D47BC89C2378D09F3DE949E5ACE9587108837F5E58384B221D0F91E62F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  Launcher/x86/mingwm10.dll
- Size 11KB
- SHA256 56a59dae638d9bb45ce729a5d6fdfb0ecbe88b37047e4d6d20dbdef1fc90bd72
- MD5 dbda60d92e774b4acb3b1cd71f909426
- SHA1 66bfe06a16025f574323a0ce64dcc7c8216eb56c
- SHA512 993a1f4af21cd5e13c3b8059cf483b10a58beb0d1777703ea07e9dcb5e7f681fa774e770abe9b6b4ca66b348997da0218d0ff67f18fcca1b3ca1ece2551d965a
- SSDEEP 96:ahfuHOIHxyOPLrHU4D+wdzpHvqsKZKnKTBKVhKRHK2FoSK8KcfK5uKxGKlJKHItQ:iuHOIE8rHI6RJyLTR24GEv
- TLSH
  T1CD32BDE1FDC65DD7EA20237C9AE69666363CF9E087438B178520A8361F52BC13ED4206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: RedLine

RedLine payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13