Overview

overview

10

Static

static

88f68d2cf2...87.exe

windows7_x64

10

88f68d2cf2...87.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88f68d2cf22596d966b604ef3dbb0a87.exe

  • Size

    630KB

  • Sample

    201103-q9radx5z9j

  • MD5

    88f68d2cf22596d966b604ef3dbb0a87

  • SHA1

    45cba40a517f9d0a127a9483dbf855832975f389

  • SHA256

    b9d943ef126c1a7022ee465708d3b1db3798d6d0d3b0f6d2109619027230cc06

  • SHA512

    9d0f02fb7087bbec91eaeaaf8065170bb62da67b9a3027718943b71e478ef506f4d98a0a35ef6144c03e6dab057dfaf38514ec96943dde66dd027b0a1cd0b430

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      88f68d2cf22596d966b604ef3dbb0a87.exe

    • Size

      630KB

    • MD5

      88f68d2cf22596d966b604ef3dbb0a87

    • SHA1

      45cba40a517f9d0a127a9483dbf855832975f389

    • SHA256

      b9d943ef126c1a7022ee465708d3b1db3798d6d0d3b0f6d2109619027230cc06

    • SHA512

      9d0f02fb7087bbec91eaeaaf8065170bb62da67b9a3027718943b71e478ef506f4d98a0a35ef6144c03e6dab057dfaf38514ec96943dde66dd027b0a1cd0b430

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks