Overview

overview

10

Static

static

7FED85FDB6...B3.exe

windows7_x64

10

7FED85FDB6...B3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7FED85FDB6ADFC8B4455DDE0B4207DB3.exe

  • Size

    4.4MB

  • Sample

    210507-8ejn8w6csx

  • MD5

    7fed85fdb6adfc8b4455dde0b4207db3

  • SHA1

    91d05589e86fe64a011b1b0a5db10ddaa6704339

  • SHA256

    feae3ba9a65d0aac7b12cd5f6793a4df892686674d1ca97bee01deac0b07e5e2

  • SHA512

    0e7d7d31d48c324550c83323af0e4f7aceee04099827e89504288338e6e4b91317806c084ca0315b9c8b772d5d1c06623cda934cbe91e12d5f496424632de738

Score
10/10
redline@gonna_supportdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

@Gonna_Support

C2

77.232.41.231:43981

Targets

    • Target

      7FED85FDB6ADFC8B4455DDE0B4207DB3.exe

    • Size

      4.4MB

    • MD5

      7fed85fdb6adfc8b4455dde0b4207db3

    • SHA1

      91d05589e86fe64a011b1b0a5db10ddaa6704339

    • SHA256

      feae3ba9a65d0aac7b12cd5f6793a4df892686674d1ca97bee01deac0b07e5e2

    • SHA512

      0e7d7d31d48c324550c83323af0e4f7aceee04099827e89504288338e6e4b91317806c084ca0315b9c8b772d5d1c06623cda934cbe91e12d5f496424632de738

    Score
    10/10
    redline@gonna_supportdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks