Overview

overview

10

Static

static

10

RedLine_Stage4.exe

windows7_x64

7

RedLine_Stage4.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RedLine_Stage4.exe

  • Size

    118KB

  • Sample

    210926-zrkvsafcdp

  • MD5

    f0f9a9448f7a0494d9bf6e11694bfce0

  • SHA1

    e3d5c8af3b294813b562fead751cc5c2f5c8a51c

  • SHA256

    2fe3f6fc8b9b9f4d1bddc0e97ddd64229da2a069cf199bcd435d14a3e27e4e19

  • SHA512

    6e65ca507544ffe889020f61f1020aac0c3d2569985bb740ecfdbaae1c46ffaa0540dd19ca9a7a07ad31c0a743e5bb49f94cedaf585e2cccd0cecf02b7516f02

Score
10/10
redlineutsdiscoveryspywarestealer

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Targets

    • Target

      RedLine_Stage4.exe

    • Size

      118KB

    • MD5

      f0f9a9448f7a0494d9bf6e11694bfce0

    • SHA1

      e3d5c8af3b294813b562fead751cc5c2f5c8a51c

    • SHA256

      2fe3f6fc8b9b9f4d1bddc0e97ddd64229da2a069cf199bcd435d14a3e27e4e19

    • SHA512

      6e65ca507544ffe889020f61f1020aac0c3d2569985bb740ecfdbaae1c46ffaa0540dd19ca9a7a07ad31c0a743e5bb49f94cedaf585e2cccd0cecf02b7516f02

    Score
    7/10
    discoveryspywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks