Overview

overview

10

Static

static

641a81b2f8...28.exe

windows7_x64

10

641a81b2f8...28.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    641a81b2f80d132ab88829aa79a18c28.exe

  • Size

    1.6MB

  • Sample

    201222-jn72qgvx22

  • MD5

    641a81b2f80d132ab88829aa79a18c28

  • SHA1

    197f8bc734bfaf0150f33f55955320e9085131d2

  • SHA256

    3e68f106af0e91006b5c058a82b01cbf91c8c1152febfa575d036521b96be76d

  • SHA512

    7e5680cdf5bd5cae86361b5e32a514410a55823fafaca6fe435a7d81b298a60bed0cfb94979ad3103c2c880be3ffaec49cf5af228284d618dc2fe1256de6ffa4

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      641a81b2f80d132ab88829aa79a18c28.exe

    • Size

      1.6MB

    • MD5

      641a81b2f80d132ab88829aa79a18c28

    • SHA1

      197f8bc734bfaf0150f33f55955320e9085131d2

    • SHA256

      3e68f106af0e91006b5c058a82b01cbf91c8c1152febfa575d036521b96be76d

    • SHA512

      7e5680cdf5bd5cae86361b5e32a514410a55823fafaca6fe435a7d81b298a60bed0cfb94979ad3103c2c880be3ffaec49cf5af228284d618dc2fe1256de6ffa4

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks