Overview

overview

10

Static

static

1330be0f94...0e.exe

windows7_x64

10

1330be0f94...0e.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1330be0f9459506cfd3d972082f3cb0e.exe

  • Size

    1.3MB

  • Sample

    211001-grrdfsahe6

  • MD5

    1330be0f9459506cfd3d972082f3cb0e

  • SHA1

    116815a43e5d9c6ae9dc998e93948e274209711a

  • SHA256

    c0da5841ddfc29dc9eea7d8d9e42d981385602f21025ec47798d302c3ef50096

  • SHA512

    0d865e09ca6ab65f617ad43d7badfbd80db79354e73178555ea2a37d9a51f40db94f7ff3c791b00da8ff84c91397a761d03b06ddac787f162b8edc23eabda1bc

Score
10/10
redlinenew1infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

new1

C2

185.180.220.105:11915

Targets

    • Target

      1330be0f9459506cfd3d972082f3cb0e.exe

    • Size

      1.3MB

    • MD5

      1330be0f9459506cfd3d972082f3cb0e

    • SHA1

      116815a43e5d9c6ae9dc998e93948e274209711a

    • SHA256

      c0da5841ddfc29dc9eea7d8d9e42d981385602f21025ec47798d302c3ef50096

    • SHA512

      0d865e09ca6ab65f617ad43d7badfbd80db79354e73178555ea2a37d9a51f40db94f7ff3c791b00da8ff84c91397a761d03b06ddac787f162b8edc23eabda1bc

    Score
    10/10
    redlinenew1infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks