Overview

overview

10

Static

static

0b58d76317...39.exe

windows7_x64

10

0b58d76317...39.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b58d763175919807c4f3190f9594039.exe

  • Size

    655KB

  • Sample

    210212-yzfmbmbez6

  • MD5

    0b58d763175919807c4f3190f9594039

  • SHA1

    90e3af167d6c4b0609fec2d1a50a51372c6dadf5

  • SHA256

    3b75b3e1b5ff77728b3b9c896968152838a7e55fdb431523af5da120ab6e137b

  • SHA512

    d7dfb3e2c91209aaa6b9b20719178fd7e1aea4c2a8f2b15b849020fc4137f7a4a2dd4d8b759a83f530d9843459034c776713b8af6a9c8589db101c7f89bb0c7a

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      0b58d763175919807c4f3190f9594039.exe

    • Size

      655KB

    • MD5

      0b58d763175919807c4f3190f9594039

    • SHA1

      90e3af167d6c4b0609fec2d1a50a51372c6dadf5

    • SHA256

      3b75b3e1b5ff77728b3b9c896968152838a7e55fdb431523af5da120ab6e137b

    • SHA512

      d7dfb3e2c91209aaa6b9b20719178fd7e1aea4c2a8f2b15b849020fc4137f7a4a2dd4d8b759a83f530d9843459034c776713b8af6a9c8589db101c7f89bb0c7a

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks