Overview

overview

10

Static

static

3cd405b892...89.exe

windows7_x64

10

3cd405b892...89.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3cd405b892ceff18db14e96d7bafb989.exe

  • Size

    669KB

  • Sample

    201102-47pnl57cre

  • MD5

    3cd405b892ceff18db14e96d7bafb989

  • SHA1

    f95f9e2de8bf06fc437a32d7b5d5153951c304c4

  • SHA256

    2dc5c0066540aaeb6212c84a4c8e9e8655f943da800b35486587e9b1a4458b08

  • SHA512

    ec770c8acb1395a2f3b18d73070dab91cea0218cb292443b41f3915a3deabeda6c1a2fb04d965c1778d5fb2cd9aa8f4ccfd1557e4b9b7da990e1845d16b818e2

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      3cd405b892ceff18db14e96d7bafb989.exe

    • Size

      669KB

    • MD5

      3cd405b892ceff18db14e96d7bafb989

    • SHA1

      f95f9e2de8bf06fc437a32d7b5d5153951c304c4

    • SHA256

      2dc5c0066540aaeb6212c84a4c8e9e8655f943da800b35486587e9b1a4458b08

    • SHA512

      ec770c8acb1395a2f3b18d73070dab91cea0218cb292443b41f3915a3deabeda6c1a2fb04d965c1778d5fb2cd9aa8f4ccfd1557e4b9b7da990e1845d16b818e2

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks