Overview

overview

10

Static

static

Setup.exe

windows7_x64

10

Setup.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup.exe

  • Size

    1.4MB

  • Sample

    210201-44jldrf1pj

  • MD5

    5ecdc36b39369e672f034c5cd503a494

  • SHA1

    b05378f6624481c7f6fee55fd0cf91c52ce25425

  • SHA256

    db369dd75a2232803191d273b532cfaf161b154deea4b77b4045ee8bd4c9d890

  • SHA512

    1029be4fb68792c469e85d2111f3be0cd8d5ba4e245a9fc325e9378263ae7176808ea6b407360c31e5926514f7e8385a4112771e1f2aa126f4af107fce9b97fc

Score
10/10
redlinediscoveryinfostealerransomwarespyware

Malware Config

Targets

    • Target

      Setup.exe

    • Size

      1.4MB

    • MD5

      5ecdc36b39369e672f034c5cd503a494

    • SHA1

      b05378f6624481c7f6fee55fd0cf91c52ce25425

    • SHA256

      db369dd75a2232803191d273b532cfaf161b154deea4b77b4045ee8bd4c9d890

    • SHA512

      1029be4fb68792c469e85d2111f3be0cd8d5ba4e245a9fc325e9378263ae7176808ea6b407360c31e5926514f7e8385a4112771e1f2aa126f4af107fce9b97fc

    Score
    10/10
    redlinediscoveryinfostealerransomwarespyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks