redline | 297fdd2d8445b1606b97bbdff267e4c856330fe5e911dc30bd5b9785ffbff559

General

Target
2026-09-23_5f7acde6121dc26c774d8a6a3a5e6d64_elex
Size 2.6MB
Sample260924-jqthjaws2n
SHA256 297fdd2d8445b1606b97bbdff267e4c856330fe5e911dc30bd5b9785ffbff559
MD5 5f7acde6121dc26c774d8a6a3a5e6d64
SHA1 9fb6a8047902db8ddf9734802e8928722dc6e8d3
SHA512 99f753982e815b475dddd59ee91f69cefa79d41f0b803ba7b9ba7f13c5cb51d45270bbb67a653620f4f059549d8306fe69ad0e06c440252eb1addd6a3c5b9697
SSDEEP 24576:pLgITLfQmMNUUIyFaYmYoxSCTkMtbqxWdNEbrYIZ7v0wF6fvMFNx6cgAEjnPqxL7:eITEmpUnMG0wFEvMfxIAUnPqxwFbcl3x
TLSH
T194C52B135A8B0D75DDD27BB4A1CB633EA734ED30CA2A8B7FB608C43959532C56C1A742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

redline

C2

79.137.192.7:39946

Attributes

auth_value
ea26be6041976e735eb8721978cd83db

Targets

- Target
  2026-09-23_5f7acde6121dc26c774d8a6a3a5e6d64_elex
- Size 2.6MB
- SHA256 297fdd2d8445b1606b97bbdff267e4c856330fe5e911dc30bd5b9785ffbff559
- MD5 5f7acde6121dc26c774d8a6a3a5e6d64
- SHA1 9fb6a8047902db8ddf9734802e8928722dc6e8d3
- SHA512 99f753982e815b475dddd59ee91f69cefa79d41f0b803ba7b9ba7f13c5cb51d45270bbb67a653620f4f059549d8306fe69ad0e06c440252eb1addd6a3c5b9697
- SSDEEP 24576:pLgITLfQmMNUUIyFaYmYoxSCTkMtbqxWdNEbrYIZ7v0wF6fvMFNx6cgAEjnPqxL7:eITEmpUnMG0wFEvMfxIAUnPqxwFbcl3x
- TLSH
  T194C52B135A8B0D75DDD27BB4A1CB633EA734ED30CA2A8B7FB608C43959532C56C1A742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery redline infostealer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: RedLine

RedLine payload

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2