redline | d8e9ec64d8d17ffc125c936a74dfedfb836f15b29340326f637285b02b2a96c1

General

Target
jaffacakes118_Fort_HC.exe
Size 213KB
Sample261012-129gkaeh79
SHA256 d8e9ec64d8d17ffc125c936a74dfedfb836f15b29340326f637285b02b2a96c1
MD5 34e330654b7660dd183c7d3bebf7b418
SHA1 2b69a0e2fa14f8159e5d37d00cd1dae904ba74cf
SHA512 b4e7e950a8df7e6c1b351780f527144634ef44b5b9d286f32baa3cd95ff3aae3c28c6df7caf046dc1150718f619a09d60d21a82aa1ab4bc7c1350d6ddd451bcb
SSDEEP 6144:g81Ltdk3p+O1mFsX9+QsICuNLeXXiUWZ:gYHnc9+SCseXXiUW
TLSH
T14F249E1774C0B071C4ABC7F112954B8B803FF67323C6C60AA31C5E1DB561AAA57B6BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

redline

C2

37.220.87.2:27924

Attributes

auth_value
a7c56867dbb5e7f508f946ee45b6a729

Targets

- Target
  jaffacakes118_Fort_HC.exe
- Size 213KB
- SHA256 d8e9ec64d8d17ffc125c936a74dfedfb836f15b29340326f637285b02b2a96c1
- MD5 34e330654b7660dd183c7d3bebf7b418
- SHA1 2b69a0e2fa14f8159e5d37d00cd1dae904ba74cf
- SHA512 b4e7e950a8df7e6c1b351780f527144634ef44b5b9d286f32baa3cd95ff3aae3c28c6df7caf046dc1150718f619a09d60d21a82aa1ab4bc7c1350d6ddd451bcb
- SSDEEP 6144:g81Ltdk3p+O1mFsX9+QsICuNLeXXiUWZ:gYHnc9+SCseXXiUW
- TLSH
  T14F249E1774C0B071C4ABC7F112954B8B803FF67323C6C60AA31C5E1DB561AAA57B6BB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery redline infostealer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: RedLine

RedLine payload

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2