Overview

overview

10

Static

static

034c7d8fab...40.exe

windows7_x64

10

034c7d8fab...40.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    034c7d8fabacc35fd6312cf438124340.exe

  • Size

    1004KB

  • Sample

    200710-81am8x5t92

  • MD5

    034c7d8fabacc35fd6312cf438124340

  • SHA1

    e3bdb12270794012fd7fbb79637fc43119751f40

  • SHA256

    95129ce014d0264688c32aaddf7707ec591f6be1335f5cd67b44e9983b61da9b

  • SHA512

    957c6a136319b5360dd05e1c3f7f580a7601c6a8c39071268f17a4cc00a6d560db4233f0b96a65357fe6c369e434d7c173849028db31aa7f57b32e50e268ee2d

Score
10/10
redlinediscoveryevasioninfostealerspywaretrojan

Malware Config

Targets

    • Target

      034c7d8fabacc35fd6312cf438124340.exe

    • Size

      1004KB

    • MD5

      034c7d8fabacc35fd6312cf438124340

    • SHA1

      e3bdb12270794012fd7fbb79637fc43119751f40

    • SHA256

      95129ce014d0264688c32aaddf7707ec591f6be1335f5cd67b44e9983b61da9b

    • SHA512

      957c6a136319b5360dd05e1c3f7f580a7601c6a8c39071268f17a4cc00a6d560db4233f0b96a65357fe6c369e434d7c173849028db31aa7f57b32e50e268ee2d

    Score
    10/10
    spywareinfostealerredlineevasiontrojandiscovery

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks for installed software on the system

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies system certificate store

      evasionspywaretrojan

    • Program crash

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks