Overview

overview

10

Static

static

fd5c2b2652...00.exe

windows7_x64

10

fd5c2b2652...00.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd5c2b26527e050096c07dcc99552100.exe

  • Size

    403KB

  • Sample

    220124-13x5xsbbeq

  • MD5

    fd5c2b26527e050096c07dcc99552100

  • SHA1

    b299699b9f1e30f7ee2c4782112679896ab36805

  • SHA256

    b011321c3f977caff0665bb91f5a78ef2486486864c18951ec2dfb19b79f0e47

  • SHA512

    2370c1d25df139439699bb43489711b46e728fa81f082e4ee5126ba5ed46dfc42269daae8dcbc86ced936ab338695e7d555fb41be854e1ee56ece334e3682819

Score
10/10
redlinenonamediscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

noname

C2

45.9.20.112:57175

Targets

    • Target

      fd5c2b26527e050096c07dcc99552100.exe

    • Size

      403KB

    • MD5

      fd5c2b26527e050096c07dcc99552100

    • SHA1

      b299699b9f1e30f7ee2c4782112679896ab36805

    • SHA256

      b011321c3f977caff0665bb91f5a78ef2486486864c18951ec2dfb19b79f0e47

    • SHA512

      2370c1d25df139439699bb43489711b46e728fa81f082e4ee5126ba5ed46dfc42269daae8dcbc86ced936ab338695e7d555fb41be854e1ee56ece334e3682819

    Score
    10/10
    redlinenonamediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks