Overview

overview

10

Static

static

c06b71d7e3...2a.exe

windows7_x64

10

c06b71d7e3...2a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c06b71d7e3dc65653794fa2ff0759f2a.exe

  • Size

    427KB

  • Sample

    210422-hz2ltbrt3n

  • MD5

    c06b71d7e3dc65653794fa2ff0759f2a

  • SHA1

    1de6518d879b92e741cb118b2aba46dc160808ca

  • SHA256

    dfecf9c450e683be8d6f11c2bd18c6c636d51824f78e7fc6d3b6e30f7ce93a3d

  • SHA512

    2471abf3f2d48fa05d28060159a613f0b2843c2349ca827d8f3c94e37b0fd5dac1f06b51cdf5482b414836df6276f80d7821815692378da5b3b2ca5b417c156c

Score
10/10
redline04-16-cr1agilenetdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

04-16-cr1

C2

drerink.xyz:80

Targets

    • Target

      c06b71d7e3dc65653794fa2ff0759f2a.exe

    • Size

      427KB

    • MD5

      c06b71d7e3dc65653794fa2ff0759f2a

    • SHA1

      1de6518d879b92e741cb118b2aba46dc160808ca

    • SHA256

      dfecf9c450e683be8d6f11c2bd18c6c636d51824f78e7fc6d3b6e30f7ce93a3d

    • SHA512

      2471abf3f2d48fa05d28060159a613f0b2843c2349ca827d8f3c94e37b0fd5dac1f06b51cdf5482b414836df6276f80d7821815692378da5b3b2ca5b417c156c

    Score
    10/10
    redline04-16-cr1agilenetdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks