Overview

overview

10

Static

static

Metamask S...or.exe

windows7-x64

3

Metamask S...or.exe

windows10-1703-x64

10

Metamask S...or.exe

windows10-2004-x64

10

Metamask S...or.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Metamask Seed Generator.zip

  • Size

    603KB

  • Sample

    220720-k98x1aedbm

  • MD5

    ef63d113bb78f3203efc013974a9e77d

  • SHA1

    a7b53308b7a5092497753accfad96991310534a6

  • SHA256

    87ac9e36b05f3d8001e92f640029350be8b8065ab72dca19b6e509caa13d68c3

  • SHA512

    8de7c5332342f90fbd3719a7d95cecebd84c62284fc5ab92ddd23c02008a78d7d4a01d442f2f92c66d1f5f3c081dd996c2c27c98670775cc7febd304ba668064

Score
10/10
redlineyoutubediscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

Youtube

C2

tecnotrendgame.ddns.net:62099

Targets

    • Target

      Metamask Seed Generator.exe

    • Size

      590KB

    • MD5

      e883f34b766540694ea524e1f8be3958

    • SHA1

      e4bc2c5cd58e2ecf9ec30768558baf29f73690d7

    • SHA256

      8fa48d81788bbd2b1ad77fbb615a5cd3084ed94badc0b9f58797c6b09bd251be

    • SHA512

      c046217c5f688eec693b4e5c91d5871c8b78887aa4a9f087a7469ae83b01169ecf3c17244b19f6b2e5d3e1aa231e6c164303bbdd9bb3723addbc0b5f86c95a17

    Score
    10/10
    redlineyoutubediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks