Overview

overview

10

Static

static

019af41176...72.exe

windows7_x64

10

019af41176...72.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    019af41176f7e25391be0fd72c1f9172.exe

  • Size

    875KB

  • Sample

    201109-kmytjr7we6

  • MD5

    019af41176f7e25391be0fd72c1f9172

  • SHA1

    62207e793fa36961a1d2527f7d3f0f4e9b968c98

  • SHA256

    b42ff896888eef8fb77d21409aa4ebcd906ff4446e21c4c7e658f569f92790f6

  • SHA512

    542607967524c853bfb8923992283dd27f0e61872c4119055952f2dbf571abfc17b136f74ab951c3c0a4ed6d92bcfc56f06fd32ff4f3c51c384a9c9349a92897

Score
10/10
redlinecoreentityinfostealerrezer0

Malware Config

Targets

    • Target

      019af41176f7e25391be0fd72c1f9172.exe

    • Size

      875KB

    • MD5

      019af41176f7e25391be0fd72c1f9172

    • SHA1

      62207e793fa36961a1d2527f7d3f0f4e9b968c98

    • SHA256

      b42ff896888eef8fb77d21409aa4ebcd906ff4446e21c4c7e658f569f92790f6

    • SHA512

      542607967524c853bfb8923992283dd27f0e61872c4119055952f2dbf571abfc17b136f74ab951c3c0a4ed6d92bcfc56f06fd32ff4f3c51c384a9c9349a92897

    Score
    10/10
    redlinecoreentityinfostealerrezer0

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks