Overview

overview

10

Static

static

fa49886693...5e.exe

windows7_x64

10

fa49886693...5e.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa4988669374b7f32ab387fe8029625e.exe

  • Size

    778KB

  • Sample

    201101-jf7hsbhnaa

  • MD5

    fa4988669374b7f32ab387fe8029625e

  • SHA1

    982be59b08cbaae6aeddbc32ae55989ac551a917

  • SHA256

    951d7b367ca9c6742c6c48a017519323a9ee9b7c3ec0fed414aabcd5fc09c26f

  • SHA512

    68c329f9c888a9034a6f4be638b7d1bff5fda2167898f3d7526089c589b68a1e535c91e57a24af6fe0cc2911243ec188a2e370e54e45b85ecb3a0fed413bea1e

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      fa4988669374b7f32ab387fe8029625e.exe

    • Size

      778KB

    • MD5

      fa4988669374b7f32ab387fe8029625e

    • SHA1

      982be59b08cbaae6aeddbc32ae55989ac551a917

    • SHA256

      951d7b367ca9c6742c6c48a017519323a9ee9b7c3ec0fed414aabcd5fc09c26f

    • SHA512

      68c329f9c888a9034a6f4be638b7d1bff5fda2167898f3d7526089c589b68a1e535c91e57a24af6fe0cc2911243ec188a2e370e54e45b85ecb3a0fed413bea1e

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks