Overview

overview

10

Static

static

Thu18f1102...b0.exe

windows7_x64

10

Thu18f1102...b0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Thu18f1102ca36b120b0.exe

  • Size

    389KB

  • Sample

    211104-zrmdlshfd2

  • MD5

    b3297e6a01982c405b14ae61e4d08f50

  • SHA1

    857e4bca996e204bfa0b3713cd4ada71096edf0c

  • SHA256

    c37e330f97f7a2b2ec7c3ad76f1770dc75198b384dd6be64b6c5c8aa336c50da

  • SHA512

    f614ba048d184bce6818e0d97fafbb40d82e279aeb2322b79005007229fd1cf115a510c5d88f48429354ba396738fe7e08f25715afbe897de7333c305c8fdd1a

Score
10/10
redlinenewjustdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

newjust

C2

135.181.129.119:4805

Targets

    • Target

      Thu18f1102ca36b120b0.exe

    • Size

      389KB

    • MD5

      b3297e6a01982c405b14ae61e4d08f50

    • SHA1

      857e4bca996e204bfa0b3713cd4ada71096edf0c

    • SHA256

      c37e330f97f7a2b2ec7c3ad76f1770dc75198b384dd6be64b6c5c8aa336c50da

    • SHA512

      f614ba048d184bce6818e0d97fafbb40d82e279aeb2322b79005007229fd1cf115a510c5d88f48429354ba396738fe7e08f25715afbe897de7333c305c8fdd1a

    Score
    10/10
    redlinenewjustdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks