Overview

overview

10

Static

static

__1000.png.exe

windows7_x64

10

__1000.png.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    __1000.png.exe.vir

  • Size

    1.2MB

  • Sample

    220619-ze9y5sbgdp

  • MD5

    926ee43e282b9774b710501c4fff41c7

  • SHA1

    4d8ebd4ac62c70e0e42d17b62a3051c686ece7df

  • SHA256

    3b38378d0b57fc75646c350f286d53ad0d7a15ebd4d103374e2e2301758ab442

  • SHA512

    9f338257255e53dc215fba6845af5a3cac39028be945481c514dd3393783a2be5f0d858ddbfba7b5716c8d62cf97870beaf467313db859ce93c601ae56c85257

Score
10/10
redline2infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

2

C2

45.142.122.179:36803

Attributes
  • auth_value

    8b4fd9f885203719dec0ceda822a4ec3

Targets

    • Target

      __1000.png.exe.vir

    • Size

      1.2MB

    • MD5

      926ee43e282b9774b710501c4fff41c7

    • SHA1

      4d8ebd4ac62c70e0e42d17b62a3051c686ece7df

    • SHA256

      3b38378d0b57fc75646c350f286d53ad0d7a15ebd4d103374e2e2301758ab442

    • SHA512

      9f338257255e53dc215fba6845af5a3cac39028be945481c514dd3393783a2be5f0d858ddbfba7b5716c8d62cf97870beaf467313db859ce93c601ae56c85257

    Score
    10/10
    redline2infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks