Overview

overview

10

Static

static

2fdbbe32c9...19.exe

windows7_x64

10

2fdbbe32c9...19.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fdbbe32c94ec82a32e5c81f31a6d6ae0688d5be8a819.exe

  • Size

    396KB

  • Sample

    211109-pwrtsaccgp

  • MD5

    6c785946fbf3d3d2d222aa290b7630c2

  • SHA1

    d8990a7d359c3054d2add6e1070370f2068759db

  • SHA256

    2fdbbe32c94ec82a32e5c81f31a6d6ae0688d5be8a819de8d468d36f54760f1b

  • SHA512

    266dbf31b831a8684026e5e9343700d33b47477d31a1eb9505158fd7b03208df7d9e54d06666b59b47dc2b010527a7e840ac7f4d3b336617f9d2187ade9b8250

Score
10/10
redline1132044836discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

1132044836

C2

185.183.32.184:80

Targets

    • Target

      2fdbbe32c94ec82a32e5c81f31a6d6ae0688d5be8a819.exe

    • Size

      396KB

    • MD5

      6c785946fbf3d3d2d222aa290b7630c2

    • SHA1

      d8990a7d359c3054d2add6e1070370f2068759db

    • SHA256

      2fdbbe32c94ec82a32e5c81f31a6d6ae0688d5be8a819de8d468d36f54760f1b

    • SHA512

      266dbf31b831a8684026e5e9343700d33b47477d31a1eb9505158fd7b03208df7d9e54d06666b59b47dc2b010527a7e840ac7f4d3b336617f9d2187ade9b8250

    Score
    10/10
    redline1132044836discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks