Overview

overview

10

Static

static

593a20557b...32.exe

windows7_x64

10

593a20557b...32.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    593a20557bc4f2e48090138ac3780b32

  • Size

    291KB

  • Sample

    210913-swwphshahm

  • MD5

    593a20557bc4f2e48090138ac3780b32

  • SHA1

    a570a1e1c270f4dde80689e600473f47fef6c985

  • SHA256

    4965e6e224897f69fa884aded52e0dd664bc21f16a0733bd01f733dee66868e8

  • SHA512

    1cf75da34b1b1b5e78de3d2a44a9a01f127ab35197b6cb6debd6212d8f6b2e492bd5d9babfb6ae0123306c306a82f7e75be6466da110ae1983048d786d5dad89

Score
10/10
redline1309discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

1309

C2

95.217.77.23:53845

Targets

    • Target

      593a20557bc4f2e48090138ac3780b32

    • Size

      291KB

    • MD5

      593a20557bc4f2e48090138ac3780b32

    • SHA1

      a570a1e1c270f4dde80689e600473f47fef6c985

    • SHA256

      4965e6e224897f69fa884aded52e0dd664bc21f16a0733bd01f733dee66868e8

    • SHA512

      1cf75da34b1b1b5e78de3d2a44a9a01f127ab35197b6cb6debd6212d8f6b2e492bd5d9babfb6ae0123306c306a82f7e75be6466da110ae1983048d786d5dad89

    Score
    10/10
    redline1309discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks