Overview

overview

10

Static

static

tradecheat.exe

windows7_x64

10

tradecheat.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tradecheat.exe

  • Size

    1.8MB

  • Sample

    211024-tvsrxafedm

  • MD5

    c7d14620434af78c9c97915ce1ad2f3e

  • SHA1

    f68964448d84fea2cb727e1048f22531e6bacb06

  • SHA256

    6c798312f1aa6826f5e1dcc49ae54d4011d0e28245b3e6be0803dfd4381c6acb

  • SHA512

    7153ad04f977df8464007f26348d28b08a7de854e6640d39cc74212a730b5f4522eb0b209edbc420f83817d05f6748a19882dd113f559fee6ad1d964d58ba132

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      tradecheat.exe

    • Size

      1.8MB

    • MD5

      c7d14620434af78c9c97915ce1ad2f3e

    • SHA1

      f68964448d84fea2cb727e1048f22531e6bacb06

    • SHA256

      6c798312f1aa6826f5e1dcc49ae54d4011d0e28245b3e6be0803dfd4381c6acb

    • SHA512

      7153ad04f977df8464007f26348d28b08a7de854e6640d39cc74212a730b5f4522eb0b209edbc420f83817d05f6748a19882dd113f559fee6ad1d964d58ba132

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks