Overview

overview

10

Static

static

gkm4040_build1.exe

windows7_x64

10

gkm4040_build1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gkm4040_build1.exe

  • Size

    3.1MB

  • Sample

    211210-1g27raaac8

  • MD5

    9eb02a3725f098731cd981fcd3afbf0c

  • SHA1

    af1a508a4842d7a6c267df916a9ec0bbdc77f657

  • SHA256

    623c98766f8086e86c41f9f06e73e338b6ffb28aa315fe737451598f3f1172e8

  • SHA512

    7bb93bf39e60f5acb2b84a05704a9737880dca9377137d4c9d0e7360f7af70ac0251c31f17ee6ab30f7f75bea978ce2a6823cccbe53f4f7c5f8f191b197f4ffb

Score
10/10
redlineevasioninfostealerpersistenceratstealertelegramtrojan

Malware Config

Targets

    • Target

      gkm4040_build1.exe

    • Size

      3.1MB

    • MD5

      9eb02a3725f098731cd981fcd3afbf0c

    • SHA1

      af1a508a4842d7a6c267df916a9ec0bbdc77f657

    • SHA256

      623c98766f8086e86c41f9f06e73e338b6ffb28aa315fe737451598f3f1172e8

    • SHA512

      7bb93bf39e60f5acb2b84a05704a9737880dca9377137d4c9d0e7360f7af70ac0251c31f17ee6ab30f7f75bea978ce2a6823cccbe53f4f7c5f8f191b197f4ffb

    Score
    10/10
    redlineevasioninfostealerpersistenceratstealertelegramtrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • TelegramRat

      Telegram_rat.

      telegramrat

    • evasion

      evasion.

      evasion

    • rl_trojan

      redline stealer.

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks