Overview

overview

10

Static

static

12259e5047...b8.exe

windows7_x64

10

12259e5047...b8.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12259e5047e75174a009fc3caa73f8b8

  • Size

    13.5MB

  • Sample

    210920-mtzqhadgb7

  • MD5

    12259e5047e75174a009fc3caa73f8b8

  • SHA1

    9578c616a78b788d77d52e5d56b97b89ad584a46

  • SHA256

    bf72cee251615ca0af6b861fd4abf781b007249d3b0bc8612bcb37bac0d427f5

  • SHA512

    63b3a5f1e5207e8df461bdd18b3fb172c194038675555b68c98bc782743a2513e58542f6d1cbd14c117cf9daeee631aee832c06fd74038a9a5b4d5f055e8c066

Score
10/10
redlinerecinfostealerpersistencespywarestealer

Malware Config

Extracted

Family

redline

Botnet

REC

C2

185.215.113.107:61144

Targets

    • Target

      12259e5047e75174a009fc3caa73f8b8

    • Size

      13.5MB

    • MD5

      12259e5047e75174a009fc3caa73f8b8

    • SHA1

      9578c616a78b788d77d52e5d56b97b89ad584a46

    • SHA256

      bf72cee251615ca0af6b861fd4abf781b007249d3b0bc8612bcb37bac0d427f5

    • SHA512

      63b3a5f1e5207e8df461bdd18b3fb172c194038675555b68c98bc782743a2513e58542f6d1cbd14c117cf9daeee631aee832c06fd74038a9a5b4d5f055e8c066

    Score
    10/10
    redlinerecinfostealerpersistencespywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks