Overview

overview

10

Static

static

ca120f69f7...c9.exe

windows7_x64

10

ca120f69f7...c9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca120f69f73a72abd0c7f05da2a653556a7abc29a793ea2ae06f4419f11313c9

  • Size

    603KB

  • Sample

    220521-blcefscaf4

  • MD5

    35329adc614b4afdf984585c386a6b16

  • SHA1

    3ce0b19b9f426fb8a1349d738d7d30fd0f8fa060

  • SHA256

    ca120f69f73a72abd0c7f05da2a653556a7abc29a793ea2ae06f4419f11313c9

  • SHA512

    94c8522e648bbed20139480748010601b0eb3bbbc387e1f5f3401dca28582cb248d7910b53ac91ccd66681b0a3647e5db0c6838c9c627def3e6628e20365e66d

Score
10/10
redline2905 ostapcoreentityinfostealerrezer0

Malware Config

Extracted

Family

redline

Botnet

2905 ostap

C2

45.66.9.166:80

Targets

    • Target

      ca120f69f73a72abd0c7f05da2a653556a7abc29a793ea2ae06f4419f11313c9

    • Size

      603KB

    • MD5

      35329adc614b4afdf984585c386a6b16

    • SHA1

      3ce0b19b9f426fb8a1349d738d7d30fd0f8fa060

    • SHA256

      ca120f69f73a72abd0c7f05da2a653556a7abc29a793ea2ae06f4419f11313c9

    • SHA512

      94c8522e648bbed20139480748010601b0eb3bbbc387e1f5f3401dca28582cb248d7910b53ac91ccd66681b0a3647e5db0c6838c9c627def3e6628e20365e66d

    Score
    10/10
    redline2905 ostapcoreentityinfostealerrezer0

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks