Overview

overview

10

Static

static

2c59b4e57c...6e.exe

windows7_x64

10

2c59b4e57c...6e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e

  • Size

    1.4MB

  • Sample

    220215-r1v34sgaa8

  • MD5

    dfcb432a6e55ed55ab7635f594a6d550

  • SHA1

    538bd66e36e97daaccbe39bab507a1e2e77fc601

  • SHA256

    2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e

  • SHA512

    ae23480fc6981dc5a831ed985217587deb8fe631e7d241c1d5639e27ef3a5b5ad90836d091280442379038b430a2145ff5e2772926e907b481a9ed200a63a816

Score
10/10
redlinegarikevasioninfostealertrojan

Malware Config

Extracted

Family

redline

Botnet

garik

C2

94.26.249.132:19205

Attributes
  • auth_value

    b066c5fcfab0da3546ce851ec2b7c262

Targets

    • Target

      2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e

    • Size

      1.4MB

    • MD5

      dfcb432a6e55ed55ab7635f594a6d550

    • SHA1

      538bd66e36e97daaccbe39bab507a1e2e77fc601

    • SHA256

      2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e

    • SHA512

      ae23480fc6981dc5a831ed985217587deb8fe631e7d241c1d5639e27ef3a5b5ad90836d091280442379038b430a2145ff5e2772926e907b481a9ed200a63a816

    Score
    10/10
    redlinegarikevasioninfostealertrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks