Overview

overview

10

Static

static

2884a1b894...5e.exe

windows7_x64

10

2884a1b894...5e.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2884a1b8944cf25dad7dda0005b1995e.exe

  • Size

    714KB

  • Sample

    201109-r7gt7wsp4j

  • MD5

    2884a1b8944cf25dad7dda0005b1995e

  • SHA1

    b0df655586ec0e4ef320c609053b1361c12a3084

  • SHA256

    c4a2c8397cfa4f7f16a317aad541b6c48e35c4420249f702b2c6f01faf66ef61

  • SHA512

    f86f5b06c467f99ca231b45bc6d444bea03107c6c3cc133dacc3033a435e92de4b9f1a170bcae55cf493e18ff80e3f1b27c58614ef1831709a087fab9d1ef789

Score
10/10
redlinecoreentityinfostealerrezer0

Malware Config

Targets

    • Target

      2884a1b8944cf25dad7dda0005b1995e.exe

    • Size

      714KB

    • MD5

      2884a1b8944cf25dad7dda0005b1995e

    • SHA1

      b0df655586ec0e4ef320c609053b1361c12a3084

    • SHA256

      c4a2c8397cfa4f7f16a317aad541b6c48e35c4420249f702b2c6f01faf66ef61

    • SHA512

      f86f5b06c467f99ca231b45bc6d444bea03107c6c3cc133dacc3033a435e92de4b9f1a170bcae55cf493e18ff80e3f1b27c58614ef1831709a087fab9d1ef789

    Score
    10/10
    redlinecoreentityinfostealerrezer0

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks