Overview

overview

10

Static

static

8fad7c49d2...d0.exe

windows7_x64

10

8fad7c49d2...d0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8fad7c49d2beb93eec738aaa54c9f9d0.exe

  • Size

    668KB

  • Sample

    201102-mrr4fm8pms

  • MD5

    8fad7c49d2beb93eec738aaa54c9f9d0

  • SHA1

    b00ffa527f48a7b4323ebf2bba31d6450b30c1d9

  • SHA256

    dc9fe75ae9a4b294880a7e28d39f15eeca4eee9996c9b4be425ffd0f9060f2ee

  • SHA512

    e366d308fa425481f061f602ccca088fd2bb21d8b3c341466a9d87eb3de2ba2994d3d7f349debba085284c131934c1c76efba608d4aecfecb327870389e29fc3

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      8fad7c49d2beb93eec738aaa54c9f9d0.exe

    • Size

      668KB

    • MD5

      8fad7c49d2beb93eec738aaa54c9f9d0

    • SHA1

      b00ffa527f48a7b4323ebf2bba31d6450b30c1d9

    • SHA256

      dc9fe75ae9a4b294880a7e28d39f15eeca4eee9996c9b4be425ffd0f9060f2ee

    • SHA512

      e366d308fa425481f061f602ccca088fd2bb21d8b3c341466a9d87eb3de2ba2994d3d7f349debba085284c131934c1c76efba608d4aecfecb327870389e29fc3

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks