Overview

overview

10

Static

static

075917b90a...fc.exe

windows7_x64

10

075917b90a...fc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    075917b90acfcbedbd9b5a96c25fccfc.exe

  • Size

    512KB

  • Sample

    210215-s9m826emgx

  • MD5

    075917b90acfcbedbd9b5a96c25fccfc

  • SHA1

    5528b58600c878c476697756fbc2055b660f3b48

  • SHA256

    435893fea822f63cc3bd3f725acd416dff2d1bd8838bf80318d195864a44de09

  • SHA512

    02a68401c35ee6ec848573b399a710003db754514dfde20e762645e265c3836c5888f2ccd4114f6f4e75639604c67101cfa69d1ff58758fac93bddc3aed8f0b2

Score
10/10
redlinediscoveryinfostealerspyware

Malware Config

Targets

    • Target

      075917b90acfcbedbd9b5a96c25fccfc.exe

    • Size

      512KB

    • MD5

      075917b90acfcbedbd9b5a96c25fccfc

    • SHA1

      5528b58600c878c476697756fbc2055b660f3b48

    • SHA256

      435893fea822f63cc3bd3f725acd416dff2d1bd8838bf80318d195864a44de09

    • SHA512

      02a68401c35ee6ec848573b399a710003db754514dfde20e762645e265c3836c5888f2ccd4114f6f4e75639604c67101cfa69d1ff58758fac93bddc3aed8f0b2

    Score
    10/10
    redlinediscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks