Overview

overview

10

Static

static

34f3000197...8f.exe

windows7_x64

10

34f3000197...8f.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34f3000197e221ad89885926051f8e8f.exe

  • Size

    440KB

  • Sample

    210926-xqbjlsfben

  • MD5

    34f3000197e221ad89885926051f8e8f

  • SHA1

    cf1f2467b58b9c3ca0fddef9c1e628235cec0378

  • SHA256

    65bbafc229aa726d189d7607d03b1c6835ddcdf8ad6ac90017749b051f6b0770

  • SHA512

    499844dbf3c2593114249d9ad78edf5e0f8d4318d5ce5e998da6235bcec119ce877784c617844c4b185a548ec54d3fb8896931c0f236c863ec5af1676aa98ab9

Score
10/10
redline@yungwoodsdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

@yungwoods

C2

51.254.69.209:48987

Targets

    • Target

      34f3000197e221ad89885926051f8e8f.exe

    • Size

      440KB

    • MD5

      34f3000197e221ad89885926051f8e8f

    • SHA1

      cf1f2467b58b9c3ca0fddef9c1e628235cec0378

    • SHA256

      65bbafc229aa726d189d7607d03b1c6835ddcdf8ad6ac90017749b051f6b0770

    • SHA512

      499844dbf3c2593114249d9ad78edf5e0f8d4318d5ce5e998da6235bcec119ce877784c617844c4b185a548ec54d3fb8896931c0f236c863ec5af1676aa98ab9

    Score
    10/10
    redline@yungwoodsdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks