Overview

overview

10

Static

static

Acrobat Cr....3.exe

windows7_x64

10

Acrobat Cr....3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Acrobat Cracker v.6.3.exe

  • Size

    1.6MB

  • Sample

    201119-yhf9j7kt6n

  • MD5

    41598929a42c3f2bb561cc704ddad70e

  • SHA1

    c60a0243e7e6220daf6890015705cd5b299f4dc2

  • SHA256

    91fb579cf12c337d31c8b753b06352cc334c3720568c2c6ddfe2dc164b5a8b1c

  • SHA512

    2db2086b8bcdf8db2335353fb4c3ce2e5f49a1f3030eca4bfd21d7c87461550b3f28a042ed4e3191530d8285b1368c7e86b13d7f4daaf33bce76d6e24651d1f6

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      Acrobat Cracker v.6.3.exe

    • Size

      1.6MB

    • MD5

      41598929a42c3f2bb561cc704ddad70e

    • SHA1

      c60a0243e7e6220daf6890015705cd5b299f4dc2

    • SHA256

      91fb579cf12c337d31c8b753b06352cc334c3720568c2c6ddfe2dc164b5a8b1c

    • SHA512

      2db2086b8bcdf8db2335353fb4c3ce2e5f49a1f3030eca4bfd21d7c87461550b3f28a042ed4e3191530d8285b1368c7e86b13d7f4daaf33bce76d6e24651d1f6

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks