Overview

overview

10

Static

static

67377882_0...OC.exe

windows7_x64

10

67377882_0...OC.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67377882_0929920010009_SHIPMENTDOC.exe

  • Size

    90KB

  • Sample

    201223-vyhlbg3hpn

  • MD5

    2bc52ac115869578510d6a84171a94c3

  • SHA1

    aa112211aad0858670e15c0d010900c229e1cddb

  • SHA256

    b1112834889060383938ed9e85940fc18d9cc7983cdc967fd0697b7d293b3f05

  • SHA512

    3bab29fa321259f75f1fb04c0ce03659fb632e15a56baf19ccd11ee51e8687f4648d2644b421d3f805e983873d0fd664efe54922ca609b599852838465eccbba

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      67377882_0929920010009_SHIPMENTDOC.exe

    • Size

      90KB

    • MD5

      2bc52ac115869578510d6a84171a94c3

    • SHA1

      aa112211aad0858670e15c0d010900c229e1cddb

    • SHA256

      b1112834889060383938ed9e85940fc18d9cc7983cdc967fd0697b7d293b3f05

    • SHA512

      3bab29fa321259f75f1fb04c0ce03659fb632e15a56baf19ccd11ee51e8687f4648d2644b421d3f805e983873d0fd664efe54922ca609b599852838465eccbba

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks