Overview

overview

10

Static

static

2AC14F94C1...A8.exe

windows7_x64

1

2AC14F94C1...A8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2AC14F94C1E8E27D024067015EE16FA8.exe

  • Size

    266KB

  • Sample

    210522-mw4hggx1qe

  • MD5

    2ac14f94c1e8e27d024067015ee16fa8

  • SHA1

    3b0e0d040c0b9bb18bdc2e1dbaf2449edb549545

  • SHA256

    07a3a8db3d5bb4b30e84ead1309b5999910a005d093854a39ef8ba581b35fcd9

  • SHA512

    55d3462c28f97eeb6fb18c7206ce1d7a187f67cb8f143d6a9957fdd22cd48744225f15353d638196f8157c2e9e43946bbe7c8f30cf77a665143b55195788237d

Score
10/10
redlinevkeylogger1infostealerkeyloggerpersistencespywarestealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

162.55.177.230:3483

Targets

    • Target

      2AC14F94C1E8E27D024067015EE16FA8.exe

    • Size

      266KB

    • MD5

      2ac14f94c1e8e27d024067015ee16fa8

    • SHA1

      3b0e0d040c0b9bb18bdc2e1dbaf2449edb549545

    • SHA256

      07a3a8db3d5bb4b30e84ead1309b5999910a005d093854a39ef8ba581b35fcd9

    • SHA512

      55d3462c28f97eeb6fb18c7206ce1d7a187f67cb8f143d6a9957fdd22cd48744225f15353d638196f8157c2e9e43946bbe7c8f30cf77a665143b55195788237d

    Score
    10/10
    redlinevkeylogger1infostealerkeyloggerpersistencespywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • VKeylogger

      A keylogger first seen in Nov 2020.

      stealerkeyloggervkeylogger

    • VKeylogger Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks