Overview

overview

10

Static

static

ce89370197...07.exe

windows7_x64

10

ce89370197...07.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ce8937019771132b670e3580b9ebc160464babde2a90d37b9d6e6df37b557e07

  • Size

    1.3MB

  • Sample

    220215-gp47jabee6

  • MD5

    844bf9c5bc654232367d6edd6a874fd0

  • SHA1

    96e159e086d9e18352d1e60cc5d5f76459ae6c3e

  • SHA256

    ce8937019771132b670e3580b9ebc160464babde2a90d37b9d6e6df37b557e07

  • SHA512

    f20d93adf81174d04ed793ebf06ec36af74e397433fd4b53e38dc11be28c74f7f92d8ca5c933b5a26e5cf18f0b3ea3d1845ee9e94f9f16e8936a40a7aae26ed6

Score
10/10
redline1011hevasioninfostealertrojan

Malware Config

Extracted

Family

redline

Botnet

1011h

C2

charirelay.xyz:80

Attributes
  • auth_value

    d922d0e6a8065ced15ac54d22fbc64f9

Targets

    • Target

      ce8937019771132b670e3580b9ebc160464babde2a90d37b9d6e6df37b557e07

    • Size

      1.3MB

    • MD5

      844bf9c5bc654232367d6edd6a874fd0

    • SHA1

      96e159e086d9e18352d1e60cc5d5f76459ae6c3e

    • SHA256

      ce8937019771132b670e3580b9ebc160464babde2a90d37b9d6e6df37b557e07

    • SHA512

      f20d93adf81174d04ed793ebf06ec36af74e397433fd4b53e38dc11be28c74f7f92d8ca5c933b5a26e5cf18f0b3ea3d1845ee9e94f9f16e8936a40a7aae26ed6

    Score
    10/10
    redline1011hevasioninfostealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks