redline | 142f3bd40a4521f39d6931c55713a75efd9546045c7c18f9adc679c5017e45f3

General

Target
jaffacakes118_142f3bd40a4521f39d6931c55713a75efd9546045c7c18f9adc679c5017e45f3
Size 2.4MB
Sample261016-j5vddaby4k
SHA256 142f3bd40a4521f39d6931c55713a75efd9546045c7c18f9adc679c5017e45f3
MD5 0e7af38bdf808e3e6528feb3cbf0528e
SHA1 11ed39e0ff7cec345b94df3824f7d4399a6cb9fb
SHA512 cb8cb46cef6c36e64734ba47de806c5b99e64efeb360187dbde3f08aa7e1f4886ce52350559a47edc94494ed456125783e0bc4137fd915107cfa44ff051a0a47
SSDEEP 24576:6AOCsYVYGP0MajMwwPQqeySV7uL4Ff/Z91QVOaftlLECWCl3RuQ553139:6nTPugf/Z9KVOaftlTl3T
TLSH
T109B51A036ACB0E75DDD63BB461CB533AA738ED30CA2A9B7FF608C53559532C4681A742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

redline

C2

79.137.192.7:39946

Attributes

auth_value
5f639e72aefb34a656c9a6d6034ff4da

Targets

- Target
  jaffacakes118_142f3bd40a4521f39d6931c55713a75efd9546045c7c18f9adc679c5017e45f3
- Size 2.4MB
- SHA256 142f3bd40a4521f39d6931c55713a75efd9546045c7c18f9adc679c5017e45f3
- MD5 0e7af38bdf808e3e6528feb3cbf0528e
- SHA1 11ed39e0ff7cec345b94df3824f7d4399a6cb9fb
- SHA512 cb8cb46cef6c36e64734ba47de806c5b99e64efeb360187dbde3f08aa7e1f4886ce52350559a47edc94494ed456125783e0bc4137fd915107cfa44ff051a0a47
- SSDEEP 24576:6AOCsYVYGP0MajMwwPQqeySV7uL4Ff/Z91QVOaftlLECWCl3RuQ553139:6nTPugf/Z9KVOaftlTl3T
- TLSH
  T109B51A036ACB0E75DDD63BB461CB533AA738ED30CA2A9B7FF608C53559532C4681A742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery redline infostealer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: RedLine

RedLine payload

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2