Overview

overview

10

Static

static

6112c72912...20.exe

windows7_x64

10

6112c72912...20.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6112c72912e12d7f3490641386adf720.exe

  • Size

    309KB

  • Sample

    210929-djjf4adcg3

  • MD5

    6112c72912e12d7f3490641386adf720

  • SHA1

    0e9e723ef7f189d679caeda6ea9444ecf1c104b9

  • SHA256

    ac098ff6d0aab414dad2bce4a4a21ade100a6d4921bf90c7890409b8d37dea05

  • SHA512

    1df7a0f7c87bbf1938b0130495247a41f1872c52a8f78b921ebcf564f86a0c3447e948ee7bd5a7db403651186febe6f2d40dc5ae7a803b17484247cf9e4b0495

Score
10/10
redline2k ruzzkidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

2k ruzzki

C2

narlelalik.xyz:12509

Targets

    • Target

      6112c72912e12d7f3490641386adf720.exe

    • Size

      309KB

    • MD5

      6112c72912e12d7f3490641386adf720

    • SHA1

      0e9e723ef7f189d679caeda6ea9444ecf1c104b9

    • SHA256

      ac098ff6d0aab414dad2bce4a4a21ade100a6d4921bf90c7890409b8d37dea05

    • SHA512

      1df7a0f7c87bbf1938b0130495247a41f1872c52a8f78b921ebcf564f86a0c3447e948ee7bd5a7db403651186febe6f2d40dc5ae7a803b17484247cf9e4b0495

    Score
    10/10
    redline2k ruzzkidiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks