Overview

overview

10

Static

static

c3cc431f03...cc.exe

windows7_x64

1

c3cc431f03...cc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3cc431f030389e18beecdc8038aacc890ad1f872a152f71f67b6aeb781a14cc

  • Size

    118KB

  • Sample

    220620-rgnjxsdgdn

  • MD5

    8f69213308358044817cb16e315025d8

  • SHA1

    b255942e19fb1680f962d1e263cea326f8bb5512

  • SHA256

    ca400904cfcdcfdd3a66aab1520944cb87ab009c931735507879d8e3c5fc0489

  • SHA512

    2c004da8668c19dd1a183f53c561aed671a560465519c312bfca7ee640a7074e3f5ab7e5f1d4830272322e6da3ee74f0d0d4a4b9f12ee5c39f46acc1701f4c3c

Score
10/10
redlinevidar1415mario2usaeutestdiscoveryinfostealerspywarestealersuricata

Malware Config

Extracted

Family

vidar

Version

52.6

Botnet

1415

C2

https://t.me/tg_dailylessons

https://busshi.moe/@olegf9844xx
Attributes
  • profile_id

    1415

Extracted

Family

redline

Botnet

USAeuTEST

C2

193.106.191.246:23196

Attributes
  • auth_value

    7dbf5ba6d421c1b0e8ce8d5867af4537

Extracted

Family

redline

Botnet

mario2

C2

193.106.191.129:80

Attributes
  • auth_value

    4ef7e3fec3a418b2f0233b604d0560d9

Targets

    • Target

      c3cc431f030389e18beecdc8038aacc890ad1f872a152f71f67b6aeb781a14cc

    • Size

      309KB

    • MD5

      1980e6ebe26338bcd3d90dcffcf6f438

    • SHA1

      c6e07445b5647bbe4cc74cd6ba5151515f591515

    • SHA256

      c3cc431f030389e18beecdc8038aacc890ad1f872a152f71f67b6aeb781a14cc

    • SHA512

      b4d855d25f8776bb4957bab47b0cfa8ce66d62ba51c11edce9876fca98490853182654ea96709c3e5b6cce6a0872ca7d370712b2d898932935c180098bd71939

    Score
    10/10
    redlinevidar1415mario2usaeutestdiscoveryinfostealerspywarestealersuricata

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

      suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved

      suricata

    • suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

      suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer

      suricata

    • Vidar Stealer

      stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

4
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Tasks