Overview

overview

10

Static

static

Minecraft_v3.2.exe

windows7_x64

10

Minecraft_v3.2.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Minecraft_v3.2.exe

  • Size

    204KB

  • Sample

    210715-lhgad4f4jn

  • MD5

    242a4e885799f3ee236c3c69ee1756d3

  • SHA1

    1a0210297cb259e5b0a0750bf7eb3407a386836b

  • SHA256

    d35d5b5ff516cdea2f6c27d47a7cf9d922bf14d4c3cef826c80f62aaad07afeb

  • SHA512

    25430d894ea4791edd1edabf757e4bb5a6c3626f552a58ea40c6c9df48ad9b3892dcc9013e54b13432f9579eb96817268b8e82f59cfadca53a709600b03c5279

Score
10/10
redlineytmaloy4agilenetdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

ytmaloy4

C2

46.8.19.196:53773

Targets

    • Target

      Minecraft_v3.2.exe

    • Size

      204KB

    • MD5

      242a4e885799f3ee236c3c69ee1756d3

    • SHA1

      1a0210297cb259e5b0a0750bf7eb3407a386836b

    • SHA256

      d35d5b5ff516cdea2f6c27d47a7cf9d922bf14d4c3cef826c80f62aaad07afeb

    • SHA512

      25430d894ea4791edd1edabf757e4bb5a6c3626f552a58ea40c6c9df48ad9b3892dcc9013e54b13432f9579eb96817268b8e82f59cfadca53a709600b03c5279

    Score
    10/10
    redlineytmaloy4agilenetdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks