redline | 0dbd10082d1de254c296f7ba2fe691e8aca204f02feee5642e757a519ea5a65f

General

Target
2026-09-21_6c20f3d1e7fc28da49dedc1331161d0e_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee
Size 574KB
Sample260922-pr49baee22
SHA256 0dbd10082d1de254c296f7ba2fe691e8aca204f02feee5642e757a519ea5a65f
MD5 6c20f3d1e7fc28da49dedc1331161d0e
SHA1 06001c4fc20ad40b08f7d42790728d24e5fb2541
SHA512 0291f0b41b11490a71bec22826065934d6ea386c07002bb61271b7a524c8260b44e59216acae6335cc13de22381b240e3551bd40d5f4899def578986fd76e66b
SSDEEP 6144:XFm3F0a3IQI5Fx+u5tl8WjmK2oVlZSBhzMwQvnmGXYNrocDJsQfuLO/5+fq:XFm10a3IQcXtl8eJrwGda8c2LOY
TLSH
T1E0C4D01232B17872E63207328E5ED6F46A5EF8624F25BBFB1214D62F09B11F2C172765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Targets

- Target
  2026-09-21_6c20f3d1e7fc28da49dedc1331161d0e_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop_tofsee
- Size 574KB
- SHA256 0dbd10082d1de254c296f7ba2fe691e8aca204f02feee5642e757a519ea5a65f
- MD5 6c20f3d1e7fc28da49dedc1331161d0e
- SHA1 06001c4fc20ad40b08f7d42790728d24e5fb2541
- SHA512 0291f0b41b11490a71bec22826065934d6ea386c07002bb61271b7a524c8260b44e59216acae6335cc13de22381b240e3551bd40d5f4899def578986fd76e66b
- SSDEEP 6144:XFm3F0a3IQI5Fx+u5tl8WjmK2oVlZSBhzMwQvnmGXYNrocDJsQfuLO/5+fq:XFm10a3IQcXtl8eJrwGda8c2LOY
- TLSH
  T1E0C4D01232B17872E63207328E5ED6F46A5EF8624F25BBFB1214D62F09B11F2C172765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

gena discovery redline infostealer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Detects executables packed with ConfuserEx Mod
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: RedLine

RedLine payload

Detects executables packed with ConfuserEx Mod

Checks computer location settings

Executes dropped EXE

ConfuserEx .NET packer

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2