Overview

overview

10

Static

static

StartGame.exe

windows7_x64

StartGame.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    StartGame.exe

  • Size

    1.9MB

  • Sample

    220426-tpl26sdce8

  • MD5

    34b54e8b6de2b4fb990da8f119c0041f

  • SHA1

    db4bf80d3b4007e2f404a923231686f9ba425868

  • SHA256

    5d7705859489383576e05748d3b2acff1a8dafac70f8901b75c890db2b82d4f6

  • SHA512

    d3dd2c4600d00e1dbd597d0b1e6f38694890e4cce8742a138f9c8f9e4c1b3308e6f54104096b245437f0d2674e0174fa61568902b93e5cec636229cd94fbe6b1

Score
10/10
redline1infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

1

C2

65.108.5.252:43673

Attributes
  • auth_value

    95517c2a2f56575288c35d9dfde4a6aa

Targets

    • Target

      StartGame.exe

    • Size

      1.9MB

    • MD5

      34b54e8b6de2b4fb990da8f119c0041f

    • SHA1

      db4bf80d3b4007e2f404a923231686f9ba425868

    • SHA256

      5d7705859489383576e05748d3b2acff1a8dafac70f8901b75c890db2b82d4f6

    • SHA512

      d3dd2c4600d00e1dbd597d0b1e6f38694890e4cce8742a138f9c8f9e4c1b3308e6f54104096b245437f0d2674e0174fa61568902b93e5cec636229cd94fbe6b1

    Score
    10/10
    redline1infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks