Overview

overview

10

Static

static

Sun03f0dc4460bc9.exe

windows7_x64

10

Sun03f0dc4460bc9.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sun03f0dc4460bc9.exe

  • Size

    389KB

  • Sample

    211031-jtxz5aceen

  • MD5

    5926205df9aec95421688c034191d5d3

  • SHA1

    6b81f52f132c84bd81e8a932760c15766db104eb

  • SHA256

    f71062ef3a53ec22a3d87cd2d85cecf96b57d7f4f1ef7bbe5e63f7927443f94a

  • SHA512

    da704935b6a621b028eac2c860b7b9fa911d92fe6f51227c5c8e90a85dbbbeccfc6d1c49eef1cc171d5c1cda04d2466226d731ef3213e7a8f780dbe361f20921

Score
10/10
redlinesrtupdate33discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

srtupdate33

C2

135.181.129.119:4805

Targets

    • Target

      Sun03f0dc4460bc9.exe

    • Size

      389KB

    • MD5

      5926205df9aec95421688c034191d5d3

    • SHA1

      6b81f52f132c84bd81e8a932760c15766db104eb

    • SHA256

      f71062ef3a53ec22a3d87cd2d85cecf96b57d7f4f1ef7bbe5e63f7927443f94a

    • SHA512

      da704935b6a621b028eac2c860b7b9fa911d92fe6f51227c5c8e90a85dbbbeccfc6d1c49eef1cc171d5c1cda04d2466226d731ef3213e7a8f780dbe361f20921

    Score
    10/10
    redlinesrtupdate33discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks