Overview

overview

10

Static

static

3

II6d3u6BssFXwheN.exe

windows7_x64

10

II6d3u6BssFXwheN.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    II6d3u6BssFXwheN.exe

  • Size

    6.9MB

  • Sample

    211114-hpsn6sdaan

  • MD5

    69d92d9eee0f985652d9a8afdfaf3768

  • SHA1

    afede92bba9584f02c0626cee9efd4f6fd7b97c1

  • SHA256

    eb82ace4891074a9c78d6a73f08e2cde43f7db5cc8eb1aab442337210cb411a2

  • SHA512

    e928ae30ec0e0ec85acaad2d24ed88874e9da8d7a4ded3cb19c30961aeef87b02204af6c6d51d63c56562358ce7f029a0fc3e7287b9a842d1d8aded2579a673c

Score
10/10
redlinediscoveryinfostealerpyinstallerspywarestealer

Malware Config

Extracted

Family

redline

C2

94.26.230.203:48759

Targets

    • Target

      II6d3u6BssFXwheN.exe

    • Size

      6.9MB

    • MD5

      69d92d9eee0f985652d9a8afdfaf3768

    • SHA1

      afede92bba9584f02c0626cee9efd4f6fd7b97c1

    • SHA256

      eb82ace4891074a9c78d6a73f08e2cde43f7db5cc8eb1aab442337210cb411a2

    • SHA512

      e928ae30ec0e0ec85acaad2d24ed88874e9da8d7a4ded3cb19c30961aeef87b02204af6c6d51d63c56562358ce7f029a0fc3e7287b9a842d1d8aded2579a673c

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks