Overview

overview

10

Static

static

usfive_202...24.exe

windows7_x64

10

usfive_202...24.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    usfive_20211021-124624

  • Size

    333KB

  • Sample

    211021-rl6ajabceq

  • MD5

    d925816145cc18afdd4675c4846bc9a7

  • SHA1

    9eb8dff855f515f3253eb2987679c462c9cab3e7

  • SHA256

    6ccde99f9a922f30985bf697ef122d1bb102993590064544c6d0cda4f53cbdcc

  • SHA512

    5caec99f2a47c64193707f5f3ccb74408eea98fd395d1fba4881f7ca39149ec3aa233ef4d85396e6e3be037bc293a138ea4e1d97528c72466e8d8c5a663f5326

Score
10/10
redlineoct21discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

oct21

C2

94.103.9.181:25690

Targets

    • Target

      usfive_20211021-124624

    • Size

      333KB

    • MD5

      d925816145cc18afdd4675c4846bc9a7

    • SHA1

      9eb8dff855f515f3253eb2987679c462c9cab3e7

    • SHA256

      6ccde99f9a922f30985bf697ef122d1bb102993590064544c6d0cda4f53cbdcc

    • SHA512

      5caec99f2a47c64193707f5f3ccb74408eea98fd395d1fba4881f7ca39149ec3aa233ef4d85396e6e3be037bc293a138ea4e1d97528c72466e8d8c5a663f5326

    Score
    10/10
    redlineoct21discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks