Overview

overview

10

Static

static

bc1f670af7...16.exe

windows7_x64

10

bc1f670af7...16.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc1f670af7d1a005020ea25d98fb851205760e374e3219c49f7a4cffc22aa916

  • Size

    299KB

  • Sample

    220129-v91lqsfdb9

  • MD5

    efe431d5e7985ac53c1ad1b0ea67000e

  • SHA1

    c7247760f6bd487b99356fae835496d43717beee

  • SHA256

    6444265820638d73680b807cbe88d5fc8d185c9a364057a9301e28714eb310ce

  • SHA512

    8170df44debee1b3f29738ab2ce799815c99dd5f75ce1d365a461f5e3c0e3741e67e6ec03269fa8a63fa7bbdc654baf015392db22464612c2f0936c7e31b99f2

Score
10/10
redlineruzkikakoytodiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Targets

    • Target

      bc1f670af7d1a005020ea25d98fb851205760e374e3219c49f7a4cffc22aa916

    • Size

      457KB

    • MD5

      c04bda20f977c6bbbd71aff8f1a02803

    • SHA1

      40064bf8f0385e558d151c032b876b080e21df72

    • SHA256

      bc1f670af7d1a005020ea25d98fb851205760e374e3219c49f7a4cffc22aa916

    • SHA512

      50a7d7165f456ea9963f83cda57795b5a8d6d041e8be4b1bd801f1b05e08e1cd0e99a71096186fce7e3d473c2c01c6285c6ae20f822d34c869b9ae1a201f5a3c

    Score
    10/10
    redlineruzkikakoytodiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks