General

  • Target

    GTA V HACK LOADER.exe

  • Size

    1.1MB

  • Sample

    220711-knc87sffbp

  • MD5

    78b4463a2bfb8006af24ba3b5e5f5ecd

  • SHA1

    c970d398489d07214ccb5f5a3fe623a749fa82b7

  • SHA256

    075c65d7a64fafe66c002d27d35dc359429ec00808a6ad222fdc51b58bd00da0

  • SHA512

    6c3f0c872dc1fc1224a89316f5d3b18a6a08535b6f85c578951c61967572a2783debd779895a6c0adee4bbd4607ab23ca5df310963ff3634865842c998bd8141

Malware Config

Extracted

Family

redline

C2

62.204.41.141:24758

Attributes
  • auth_value

    e175ba0fcadafb575694f32d59147a70

Targets

    • Target

      GTA V HACK LOADER.exe

    • Size

      1.1MB

    • MD5

      78b4463a2bfb8006af24ba3b5e5f5ecd

    • SHA1

      c970d398489d07214ccb5f5a3fe623a749fa82b7

    • SHA256

      075c65d7a64fafe66c002d27d35dc359429ec00808a6ad222fdc51b58bd00da0

    • SHA512

      6c3f0c872dc1fc1224a89316f5d3b18a6a08535b6f85c578951c61967572a2783debd779895a6c0adee4bbd4607ab23ca5df310963ff3634865842c998bd8141

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • YTStealer

      YTStealer is a malware designed to steal YouTube authentication cookies.

    • YTStealer payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks