Overview

overview

10

Static

static

StartGame.exe

windows7_x64

10

StartGame.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    StartGame.exe

  • Size

    1.3MB

  • Sample

    220508-mwtx2agbd4

  • MD5

    375ebc4cb338ee7b851f666fe02156d2

  • SHA1

    b04930e12e7670501b4291a4bce5814878053a5a

  • SHA256

    b462c62d0f14acebdbfde12ca68cd6b749847b73d8483232fe265c80c2d8b1ac

  • SHA512

    21fa80fd5e72bda76fd26d0e8a0943599ccd017978c146e3f1182ebcc3f05e45d273c29e599e4d699b2997efe69be0677528fab9df74e73243d53fb66a8ddcd2

Score
10/10
redline1infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

1

C2

65.108.141.58:38640

Attributes
  • auth_value

    95517c2a2f56575288c35d9dfde4a6aa

Targets

    • Target

      StartGame.exe

    • Size

      1.3MB

    • MD5

      375ebc4cb338ee7b851f666fe02156d2

    • SHA1

      b04930e12e7670501b4291a4bce5814878053a5a

    • SHA256

      b462c62d0f14acebdbfde12ca68cd6b749847b73d8483232fe265c80c2d8b1ac

    • SHA512

      21fa80fd5e72bda76fd26d0e8a0943599ccd017978c146e3f1182ebcc3f05e45d273c29e599e4d699b2997efe69be0677528fab9df74e73243d53fb66a8ddcd2

    Score
    10/10
    redline1infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks