Overview

overview

10

Static

static

686a4b97ac...3b.exe

windows7_x64

10

686a4b97ac...3b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    686a4b97ac3658409328ff06350a2af5d637cbd7bcd6ae9b60d80f52244a803b

  • Size

    851KB

  • Sample

    220521-npy4vaeaa7

  • MD5

    3537bace415d485bb0528309f957c4cb

  • SHA1

    e438188ecf9b4624262983cb61d92476040304e4

  • SHA256

    686a4b97ac3658409328ff06350a2af5d637cbd7bcd6ae9b60d80f52244a803b

  • SHA512

    bf18cc15c180d2cde71554bf2504344434cd0d4df64dc445931cd02694469c267adbeb028b9e306b5fb340020fc73eb4fb579fb3094c5d59eec55061d5c958d5

Score
10/10
redlinesekscoreentityinfostealerrezer0

Malware Config

Extracted

Family

redline

Botnet

seks

C2

45.153.229.9:80

Targets

    • Target

      686a4b97ac3658409328ff06350a2af5d637cbd7bcd6ae9b60d80f52244a803b

    • Size

      851KB

    • MD5

      3537bace415d485bb0528309f957c4cb

    • SHA1

      e438188ecf9b4624262983cb61d92476040304e4

    • SHA256

      686a4b97ac3658409328ff06350a2af5d637cbd7bcd6ae9b60d80f52244a803b

    • SHA512

      bf18cc15c180d2cde71554bf2504344434cd0d4df64dc445931cd02694469c267adbeb028b9e306b5fb340020fc73eb4fb579fb3094c5d59eec55061d5c958d5

    Score
    10/10
    redlinesekscoreentityinfostealerrezer0

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks