Overview

overview

10

Static

static

67377882.EXE

windows7_x64

10

67377882.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67377882_0929920010009_QUOTEDOC.IMG

  • Size

    1.2MB

  • Sample

    201223-lmsr73q3fe

  • MD5

    421793556a7c3709d5530825beb0da4c

  • SHA1

    d939b028671abd1e6aab4a6e5192f6a51291ee25

  • SHA256

    19a9ce5fb31d34815b41ab715609e79453319d0afd597a48ba1c463105a6d3a4

  • SHA512

    a4a9f185d3004082adcc17cdf2fdfd80926b7d652176dd1c2fd83ebda83d771101ad6710c571f7cf9972afc4b9e645e929c290945063a50fe25dbc23a4c6a1f4

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      67377882.EXE

    • Size

      90KB

    • MD5

      2bc52ac115869578510d6a84171a94c3

    • SHA1

      aa112211aad0858670e15c0d010900c229e1cddb

    • SHA256

      b1112834889060383938ed9e85940fc18d9cc7983cdc967fd0697b7d293b3f05

    • SHA512

      3bab29fa321259f75f1fb04c0ce03659fb632e15a56baf19ccd11ee51e8687f4648d2644b421d3f805e983873d0fd664efe54922ca609b599852838465eccbba

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks