Overview

overview

10

Static

static

83266F04C5...AE.exe

windows7_x64

10

83266F04C5...AE.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    83266F04C5408EF7BC34322915EFF1AE.exe

  • Size

    20KB

  • Sample

    210504-mx343xxk1a

  • MD5

    83266f04c5408ef7bc34322915eff1ae

  • SHA1

    f3873df5bf26f7ec46cf95e673b1eec847ee1727

  • SHA256

    9658197c370e5eb1ab5d88687883b342f5b2accda492657e9cb3ca9412ac06ac

  • SHA512

    833179cee4a107b0dd51c4df4c02217af25b0bf4157dc35aff7c3b594adb1d1fea4096495059f49b160a1d1e494580399abf59f0d665ff4cda7fcd20cd1bf5c2

Score
10/10
redlinenewinfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

NEW

C2

91.210.170.102:1030

Targets

    • Target

      83266F04C5408EF7BC34322915EFF1AE.exe

    • Size

      20KB

    • MD5

      83266f04c5408ef7bc34322915eff1ae

    • SHA1

      f3873df5bf26f7ec46cf95e673b1eec847ee1727

    • SHA256

      9658197c370e5eb1ab5d88687883b342f5b2accda492657e9cb3ca9412ac06ac

    • SHA512

      833179cee4a107b0dd51c4df4c02217af25b0bf4157dc35aff7c3b594adb1d1fea4096495059f49b160a1d1e494580399abf59f0d665ff4cda7fcd20cd1bf5c2

    Score
    10/10
    redlinenewinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks