Overview

overview

10

Static

static

5

63c0b388d3...ac.exe

windows10-2004-x64

10

63c0b388d3...ac.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    63c0b388d3c89bc4b2025b3084fa94b012c82a0f2d7c3b46324b9ab74a9f23ac.bin
  • Size 13.0MB
  • Sample260826-dtwjeabe77
  • SHA256 63c0b388d3c89bc4b2025b3084fa94b012c82a0f2d7c3b46324b9ab74a9f23ac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
redline195captaindiscoveryexecutioninfostealerinstallerpersistence

Malware Config

Extracted

Family

  • redline

Botnet

  • 195Captain

C2

  • 88.214.25.15:39933

Attributes
  • auth_value

    6e0f225ab10be363cc61746a19446943

Targets

    • Target
      63c0b388d3c89bc4b2025b3084fa94b012c82a0f2d7c3b46324b9ab74a9f23ac.bin
    • Size 13.0MB
    • SHA256 63c0b388d3c89bc4b2025b3084fa94b012c82a0f2d7c3b46324b9ab74a9f23ac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    195captaindiscoveryexecutionredlineinfostealerinstallerpersistence

    • Family: RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • SmartAssembly .NET packer

      Detects SmartAssembly .NET packer.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks