Overview

overview

10

Static

static

93b5fa6fdf...9b.exe

windows7_x64

10

93b5fa6fdf...9b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    93b5fa6fdf4b982c8161b242da80e59b.exe

  • Size

    1.4MB

  • Sample

    220713-dr1ekshdcq

  • MD5

    d51bf028b42f948631b0657346dea673

  • SHA1

    47ced9e32dd5a4fed144c4e6c61364be296437ec

  • SHA256

    8b5f253885ec634e6c19caaca7da017f017406276bf1442980a215f0d2d49414

  • SHA512

    9ea2e17f368af1e87848a9e8be32f9d8fee1d3071404a569c6ca9e44290b29d314f174bda920733e86ed1ba77ef5afd153dc63da4304cf06acb4d462ac8a6a32

Score
10/10
redlineruzinfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

ruz

C2

185.106.92.128:16976

Attributes
  • auth_value

    b5178f81ea8830c13e88c402dccf09f0

Targets

    • Target

      93b5fa6fdf4b982c8161b242da80e59b.exe

    • Size

      1.4MB

    • MD5

      d51bf028b42f948631b0657346dea673

    • SHA1

      47ced9e32dd5a4fed144c4e6c61364be296437ec

    • SHA256

      8b5f253885ec634e6c19caaca7da017f017406276bf1442980a215f0d2d49414

    • SHA512

      9ea2e17f368af1e87848a9e8be32f9d8fee1d3071404a569c6ca9e44290b29d314f174bda920733e86ed1ba77ef5afd153dc63da4304cf06acb4d462ac8a6a32

    Score
    10/10
    redlineruzinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks