Overview

overview

10

Static

static

438f3c1a14...8b.exe

windows7_x64

10

438f3c1a14...8b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    438f3c1a14e504b17e05538bf5b7418b.exe

  • Size

    582KB

  • Sample

    201104-dm5byqb1xx

  • MD5

    438f3c1a14e504b17e05538bf5b7418b

  • SHA1

    03ad0d57abc312208365adc88e73a2347c713404

  • SHA256

    2411f8f013897aa11ca27a8286d3850e10270d9bf7ef1de6ad7294906f03fbd9

  • SHA512

    7bd6728355d78d44336da4403c9d72a4eee37cfd95e667bf74d813804c07fd43112b4ad19e022aede1fdde90c17483d4c8f97ba948e3300f955efa30df6ede2b

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      438f3c1a14e504b17e05538bf5b7418b.exe

    • Size

      582KB

    • MD5

      438f3c1a14e504b17e05538bf5b7418b

    • SHA1

      03ad0d57abc312208365adc88e73a2347c713404

    • SHA256

      2411f8f013897aa11ca27a8286d3850e10270d9bf7ef1de6ad7294906f03fbd9

    • SHA512

      7bd6728355d78d44336da4403c9d72a4eee37cfd95e667bf74d813804c07fd43112b4ad19e022aede1fdde90c17483d4c8f97ba948e3300f955efa30df6ede2b

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks