Overview

overview

10

Static

static

d23377638c...32.exe

windows7_x64

d23377638c...32.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d23377638cab0ee29ab55a5312279c32.exe

  • Size

    1.9MB

  • Sample

    220412-sgqjyscggm

  • MD5

    d23377638cab0ee29ab55a5312279c32

  • SHA1

    c97a094fb56509a79cdec0a56a5099d77aadd7a5

  • SHA256

    148607dfd0bbe0d5b58268c6bd252a2cdbd2271e4f1b43138eb7de47eb51bf65

  • SHA512

    e4eddf8407bb96b1916e6a32376ec6950dfa822d36519ad8cab03ac57a391bd49d61b003ce261eccabba0bbf73788e77739bf8426b95a6adc306a1311f8a7004

Score
10/10
redline@ansdvsvsvdinfostealerspywarevmprotect

Malware Config

Extracted

Family

redline

Botnet

@ansdvsvsvd

C2

46.8.220.88:65531

Attributes
  • auth_value

    d7b874c6650abbcb219b4f56f4676fee

Targets

    • Target

      d23377638cab0ee29ab55a5312279c32.exe

    • Size

      1.9MB

    • MD5

      d23377638cab0ee29ab55a5312279c32

    • SHA1

      c97a094fb56509a79cdec0a56a5099d77aadd7a5

    • SHA256

      148607dfd0bbe0d5b58268c6bd252a2cdbd2271e4f1b43138eb7de47eb51bf65

    • SHA512

      e4eddf8407bb96b1916e6a32376ec6950dfa822d36519ad8cab03ac57a391bd49d61b003ce261eccabba0bbf73788e77739bf8426b95a6adc306a1311f8a7004

    Score
    10/10
    redline@ansdvsvsvdinfostealerspywarevmprotect

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks