Overview

overview

10

Static

static

GTA 5 mod menu.exe

windows7_x64

10

GTA 5 mod menu.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GTA 5 mod menu.exe

  • Size

    824KB

  • Sample

    211214-g8hsmsgccp

  • MD5

    14864038651d6da1754cb6adc665df38

  • SHA1

    8da68bae81ae654bbe5d1d2c8a33f7df4fa543b5

  • SHA256

    d9ab32db1d3868cc361bd84eedecb0cdfe069e2e0ac6e64fc8efaff1e0df507d

  • SHA512

    54bcff8a073d6dda453d1d12e0849c08c610189ab4033cfc1e05637dc06cf2b4eaf9690b12edaf95ad23df03530abbd3d2d40fea1435379f56fea2df0716adf1

Score
10/10
redlinecheatxxluchxx1discoveryinfostealerpersistencespywarestealer

Malware Config

Extracted

Family

redline

C2

185.183.35.89:2378

Extracted

Family

redline

Botnet

xxluchxx1

C2

212.86.102.63:62907

Extracted

Family

redline

Botnet

cheat

C2

185.112.83.21:21142

Targets

    • Target

      GTA 5 mod menu.exe

    • Size

      824KB

    • MD5

      14864038651d6da1754cb6adc665df38

    • SHA1

      8da68bae81ae654bbe5d1d2c8a33f7df4fa543b5

    • SHA256

      d9ab32db1d3868cc361bd84eedecb0cdfe069e2e0ac6e64fc8efaff1e0df507d

    • SHA512

      54bcff8a073d6dda453d1d12e0849c08c610189ab4033cfc1e05637dc06cf2b4eaf9690b12edaf95ad23df03530abbd3d2d40fea1435379f56fea2df0716adf1

    Score
    10/10
    redlinediscoveryinfostealerspywarestealercheatxxluchxx1persistence

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks