Overview

overview

10

Static

static

e2ad8356a0...b8.exe

windows7_x64

10

e2ad8356a0...b8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2ad8356a0f8868549918da28a853eb8.exe

  • Size

    457KB

  • Sample

    210507-shrj2wzlrn

  • MD5

    e2ad8356a0f8868549918da28a853eb8

  • SHA1

    a54d44cf9ebf627de89c3bd7b5ec5685f15538af

  • SHA256

    78dfcb8de3fc0b3cc573370bd92f0efd88a151e06d8e32fb6db12ca6daa09a00

  • SHA512

    5d3d904d4a05eafecbb74a338ea7dc3b39166773aedf73e3bf8c4624254d6438d22e318982cab9dc47bec01e4f279ce673afc72bc1d4168b3239d372d215badc

Score
10/10
redlinevidar890vrdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

VR

C2

199.195.251.96:43073

Extracted

Family

vidar

Version

38.7

Botnet

890

C2

https://HAL9THapi.faceit.comramilgame

Attributes
  • profile_id

    890

Targets

    • Target

      e2ad8356a0f8868549918da28a853eb8.exe

    • Size

      457KB

    • MD5

      e2ad8356a0f8868549918da28a853eb8

    • SHA1

      a54d44cf9ebf627de89c3bd7b5ec5685f15538af

    • SHA256

      78dfcb8de3fc0b3cc573370bd92f0efd88a151e06d8e32fb6db12ca6daa09a00

    • SHA512

      5d3d904d4a05eafecbb74a338ea7dc3b39166773aedf73e3bf8c4624254d6438d22e318982cab9dc47bec01e4f279ce673afc72bc1d4168b3239d372d215badc

    Score
    10/10
    redlinevrinfostealerspywarevidar890discoverystealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

4
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Tasks