Overview

overview

10

Static

static

0f63b4b465...1b.exe

windows7_x64

10

0f63b4b465...1b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe

  • Size

    392KB

  • Sample

    220526-ce8prafea2

  • MD5

    5fea51478a01f10a78d428751e973aba

  • SHA1

    cb7f1e3acc3636a6f890edb8c44d0abe2674ec1c

  • SHA256

    0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b

  • SHA512

    47ea5c07b4d9d2bd5f9045906da94961f9d7d64e55c992435bdae2d21334daed98f096892da46f2bd18637f48ecac6bc80d6531c5a1cacceb7f3a46182e103c6

Score
10/10
arkeiredline04062022defaultinfostealerstealer

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://62.204.41.69/p8jG9WvgbE.php

Extracted

Family

redline

Botnet

04062022

C2

62.204.41.166:27688

Attributes
  • auth_value

    48182fe753fa2aff7472da064aa2a5d9

Targets

    • Target

      0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe

    • Size

      392KB

    • MD5

      5fea51478a01f10a78d428751e973aba

    • SHA1

      cb7f1e3acc3636a6f890edb8c44d0abe2674ec1c

    • SHA256

      0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b

    • SHA512

      47ea5c07b4d9d2bd5f9045906da94961f9d7d64e55c992435bdae2d21334daed98f096892da46f2bd18637f48ecac6bc80d6531c5a1cacceb7f3a46182e103c6

    Score
    10/10
    arkeiredline04062022defaultinfostealerstealer

    • Arkei

      Arkei is an infostealer written in C++.

      stealerarkei

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks