General

  • Target

    Document.pdf.rar

  • Size

    5.0MB

  • Sample

    220724-sjy9wagebk

  • MD5

    934800c7a05d7d01b95dae2e43629da9

  • SHA1

    c75abbd12143d8a067b4f333c7ff434047217fee

  • SHA256

    6c8f0778c3e717db0505aa02c6d3b0cd0d25cf8d5210c5ab6aa389a927b855d7

  • SHA512

    28c5846eec64c7b2a183b6dabae3e563a739c794161ac95c00ac31f81b107c001dc25afb9b9a806847deb76221bd881a1e521a1c0ca54769824fe40cf94e5f24

Malware Config

Extracted

Family

redline

Botnet

1

C2

62.204.41.139:25190

Attributes
  • auth_value

    2c239ad7c28c8eab1f9626557bb9457a

Targets

    • Target

      Document.pdf/App Settings/WorkplaceJoin.admx

    • Size

      1KB

    • MD5

      4a94b4f104af2c09215eb52d7f84f748

    • SHA1

      5c414d468a0b571ca9fec00364dd4e2a185dbe92

    • SHA256

      5fabf5c534f78ce92bf7daa6d4ade2dd61002e689a8246928209bf38d7bf1bee

    • SHA512

      971a7f298fb6ece17bd9e02d636988960b4955ed8c6e44d271f4405e06268b65db6ce396caeeb41113ef2d220418c7c0bd48f3dc5852de76331eec0307516af4

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/ActiveXInstallService.adml

    • Size

      5KB

    • MD5

      46876b1e6c8ba1fbf3abc838ccf809b0

    • SHA1

      45ce70edd0ca87a5920d43385066087df134e30f

    • SHA256

      f49428cabb6f6671d95ef214133100c268d2ab04dbf0f095dd08b0105ed9d8a7

    • SHA512

      702c319b2d181753be99d99c3dff9f6c578934067c89a614e9e4b0a5da6a0fb3545a3ba4986e12e9da5de8c6af56780982d181a8d949a6e573af725e2505deca

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/AddRemovePrograms.adml

    • Size

      10KB

    • MD5

      dfe20a0ca8674d6eaea280c139e2688a

    • SHA1

      97027b92d40f5029ff296a9ea3105b775b50c209

    • SHA256

      c97cd236f8be2b235685d3d16632482839208604db3f550f9524eafda33b9ca9

    • SHA512

      120c45bd17045b6f3d4a9295e1888d81ffa99ed0f1d146aa2eec387c1187eef8c718179771bc0cdbe01a37a487d933f55c92f6f37954f392f007cbfaa2aec877

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/AppCompat.adml

    • Size

      9KB

    • MD5

      93c28840d18ed15af63308926f5aac66

    • SHA1

      5ed7a8056f1e8a68fea17c6ef81b695df8a3ea70

    • SHA256

      0ac43a8df0e8795968c0f9b6ecc6fbf620b761c128545ad689eec5dff21f5f1d

    • SHA512

      653b9905dc0bbde62f06efa1c613f4e4a0823331d31d396db0226fdb41a9ad4d148c1b5dabfa0ca64a74156f5ad446428f3344ffe75828a7c8225d3f0d214758

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/AppXRuntime.adml

    • Size

      4KB

    • MD5

      bf19db2e91edefe517515ba23b30103e

    • SHA1

      324d98b315d7f8e096d8d61505610706d0c73856

    • SHA256

      42778994d23cdb74c446e70c30942991e89df6aacc1225aebb05464d69da6dec

    • SHA512

      9c193cd9597f90913643cdd2079e36930e60b6ab539d96ba0d5da7ea2b5dde0b78d7451d0a4ac37cbbb8a90c548285fbf640099eda949665e186586d893adb14

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/AppxPackageManager.adml

    • Size

      3KB

    • MD5

      b182f0b429a84d7e97c3d50eadf154a5

    • SHA1

      87dda04edcfe5e6c22f0224d9ee8375e0920b7f6

    • SHA256

      5cd8b222aecbdeac3df2de6b774af7e02988981136f6e5e9cd3d12735c6a6416

    • SHA512

      c42670fa053734c1b909fbb1ae189d4acf72b290679c1564d78276022bdf0afd279558c608f00953325e5aee47eb93df35c5afdbb29f698e5c8f808610db5055

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/AttachmentManager.adml

    • Size

      9KB

    • MD5

      156adebca5cd43e0d849f921b26594c3

    • SHA1

      0dcda3a3c5cdb824d7fae9fd2d52638de6bac841

    • SHA256

      6974aebdcb65ab63decd224d3c060f0afca11e00c781657ead44f64073094bf8

    • SHA512

      32dc4890719aaebc7cb5a088ef7c4fd7a86207c36e76c0fa60584e3df0687c2df297cbf82750885bcd42542700bd0d14011d57d9ced9fc32e582f70061c68013

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/AuditSettings.adml

    • Size

      1KB

    • MD5

      71075fce08402095aeafbe57962a1f5b

    • SHA1

      f76fae255aa5454217fe973c4a8035ec9005b923

    • SHA256

      6928faad9624bbf4c74f6c138496a4c6ae8d04919c3de9591568300c1dd39e59

    • SHA512

      9df7480e584b16d1b504e2503b3c4c8422efc2fa37d9a4aceb8a7aea0561c0d73e8e73cb21fea20c6ec3bbbcb715c155efda7b8e38b7b448bcda5db10d773de4

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/AutoPlay.adml

    • Size

      4KB

    • MD5

      935c602dad3f4335bd16c269e66dbfaa

    • SHA1

      3df4dc6d55af20f0593d807fb4fdefb23cc3355a

    • SHA256

      8773998440c8d534fa69833174d05d09088f07e6e5c0e41d7c04a229c7903879

    • SHA512

      05abffc0ce836f7438bc711a9d2b5ceb8f3f1c48be2ac9c1a91d286aed6fc4c8d740ae802dcd2cc65d066972dc8daa84ad8a10fa775d66cb5f3de34688d975ec

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/Biometrics.adml

    • Size

      4KB

    • MD5

      c32f834c78dc4db3c12084ab5115e4a5

    • SHA1

      be211306e8ba801edd43e68e28f98947354a35bc

    • SHA256

      4222d7c39b72f570c01f76ee084278bd32619d039f197a1aae0b508c4e2caf32

    • SHA512

      2551575c490a8b4c36fd0e44b4e7c27693df94c74715bc0f242be2f947ae2af097d574ac1823f3acc71e8d69c17d6257192aab1255b25c3122f4196c10b9f674

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/Bits.adml

    • Size

      31KB

    • MD5

      f6e746cd330a73b928c14770d9645bd0

    • SHA1

      7eded72eb36035a93af3943b6f5f330082307968

    • SHA256

      80d730b14bbb66b29360c108c8a57e09aa33e57dc1c9eaffcad5d66b3ef98c31

    • SHA512

      6295e9062941daedcf4bf3e5beba03010afde880f43e95052dbce3fdb485c92c73b0cb57e9374f691c79fa43044cfcbbdb92cde189e1c3aff90024b19b525f1e

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/CEIPEnable.adml

    • Size

      1KB

    • MD5

      cb1e5dcf00dd4aa26834f7f02ea4aa0e

    • SHA1

      eaebb6a75fe6aeec3afe914df9dad9bcb08702c1

    • SHA256

      7651f59a99180721f39b02391bb51d382b39dbcd15e3e2245b10778b7a8a5d95

    • SHA512

      bc84bd30e99735495803360f061088334736caf9d7ae1c5fad9c484d949991f09c59d6fb818de35f6328e94fedd63c2c6d80d63acdf616bf936762cbf656ae3a

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/COM.adml

    • Size

      1KB

    • MD5

      33757eac0441251ace18bd74ff8e2bd0

    • SHA1

      b9dbc0b240cf803afacb5d8d9ad26e39b757b04b

    • SHA256

      44fa3b1e818ef70305ad41012d78cf140851ec0949d4f2457f60c295e31c8edc

    • SHA512

      5fb7bd40c37eab269c7e9cf72efb29d6a6a2ef76db29dadd628866143a15fcee46c865be54c66d7c6ade13766ff1a3028912bdf8be05f1a6cd69d254431180c2

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/CipherSuiteOrder.adml

    • Size

      5KB

    • MD5

      f7e00a4abe6853a853d65fb722604674

    • SHA1

      9cfd9b20c60fb7024f91a7902d84182081427d7f

    • SHA256

      4e01b6a54c1b3933d33645729af7f69e50d687c37db985a924917e6f8acab15b

    • SHA512

      2adac9cda13b12f0c2b2f7e9c9b943b50be9a217fb32b486f783a5d842a820f2f2928e5336de6e4fca4b5cd9fc4f2d7faa09f6c8285550ca7b3bd19e0ce4ca8b

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/Conf.adml

    • Size

      10KB

    • MD5

      797657fcfbc025f92f896b0095d1f6e4

    • SHA1

      f357f8b9a9671f711eae5beb7759a2ef73b953e9

    • SHA256

      032f6bb5fba082ca24ea70f6cbdc25e913fd43b68a44582ab30aeb29509fc2ed

    • SHA512

      9c90fee9737a7f66cd50b43c30a2ba05dc861a76618612dc744f7075d3296dde577589060d3cc5779e44ca14add42502420dcdf9a68825817795fc89418847dd

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/ControlPanel.adml

    • Size

      6KB

    • MD5

      02f20efb8f224de1bece4fa4fadf1442

    • SHA1

      16091d04a7a93cc21a3935841d1f30c643c2a782

    • SHA256

      2d07c5b7079ed696aa73a4806a1b1feb2863b6a579033ef1f0a10e3d5d5e5fbc

    • SHA512

      d7239c57fa747f36c770d68bbdf31354a9c53d7a7aa3530ce7367fe612ce04b903142cdbbfcbac11098d47e00d58b0c6620ef18ce324ad9933cbeb0fb5b6d15d

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/ControlPanelDisplay.adml

    • Size

      20KB

    • MD5

      61cb7046c23a14515c58521dad36ab6f

    • SHA1

      62ec7a88975656944fd8ca72924a916336112465

    • SHA256

      a4f9a17502e8aba9e82c5c324cbed40e109a565ca2e27b3d79389f1a595b3ccd

    • SHA512

      13473deade6477440d9515c9fc6babecdb59fe9a806633b003b14e71ec6e762dd9e13a9bfd1dfed554d7ca6a664b3c1ef0ceb7c8278f22cc0e0eeb793e697c1f

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/Cpls.adml

    • Size

      1KB

    • MD5

      3a236d3ed9a6eae336de47bd71132d58

    • SHA1

      621c59891b91951f2e863eefea2d8310fb5125e3

    • SHA256

      ef075f5436a4117c29f2d6689a8ed6acc3ba22eafbdeea20c2349dba5cfe1f33

    • SHA512

      862aabb60effac016188cf56bb6ec48f7e4f6847b4a1a4a525c1fd93daa0269e0cb02dc8362f5b3029f817d1096b8c5bb48fa1717fe4084e2a99cde13a3ce573

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/CredSsp.adml

    • Size

      19KB

    • MD5

      3f887766536ae5c7677e841c9a1e86f6

    • SHA1

      c3bfb966d06df84a5bd9fcdd9c0caf23a4f85b28

    • SHA256

      91a36f497d459ef96b4cedb88ee0884651d8b5c0eabce1c1f4fec6d49ff71a31

    • SHA512

      7777ff19b4b1108a2688d02f25ac69e3f66d87f44a42ad60596b447188728b231e148e67390b39b7cbcf62e83121ecb55a84cb3d72a55827c0489fadaba5469c

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/CredUI.adml

    • Size

      3KB

    • MD5

      1c00f0e54b646baca8571fc0b7be9582

    • SHA1

      0494d0849b95970d96e480c9b00c3694e4d50029

    • SHA256

      625371bba40530a9a4a88e167b4870634f7583bb601d16954ed8ff4a0e5242e9

    • SHA512

      99a2b51a6addf470b15dfdc2d3d32ca305113c427cdf7c3b85fd3bd43f17b989b5bea38ba78821da5a8978437dd3e484ccb283d9b01b737c05c4b7d82288d749

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/CredentialProviders.adml

    • Size

      5KB

    • MD5

      b735ff00bd6511f0525c74881042cfbf

    • SHA1

      f9540a99e5654ea5f6b7aaf49ce35f591cec2863

    • SHA256

      ff1b853b846ea63064ad460b42c44230de008297b6a2ddb8daa48991a5684c14

    • SHA512

      a585ae89c4b13a6a2de50d414069fe40d3db53395a4e79b5865b530acc6963b2c89647d2735b27229503b58bac47b4c43b38e6e2beb00b81ec6f1d76db441c06

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/CtrlAltDel.adml

    • Size

      3KB

    • MD5

      8eb6cbecfcfb7fb15e453e235713f0d2

    • SHA1

      37170ba6139bd471c4121ed7747e8c9544e64e4a

    • SHA256

      23eaf2144b343acce5ec33dfb0363ba5b53e1ed8f5e0557f7597f02c1a659b0c

    • SHA512

      f3b96c2721592e9c5cd8caf20daccae170b46bdbbbd24d4a6d1acc3ca3d10bfa9ac23da2b5b3f9cf7d9f7918236c1c686918bb392595c634e97b56070aede007

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DCOM.adml

    • Size

      4KB

    • MD5

      7df9e61d5f72660a48741a9d1ae6df2a

    • SHA1

      a623bd2021eaa8863519e110e2c4d141d68e6dee

    • SHA256

      bd0e69bf353115e23b4344875da15df78bd4adf676eeab35aed30a21c129ebed

    • SHA512

      726fc2bd5444e1791811c9f39b3b535d155aa0ba2ac8b50f7a8b6faf48e7bedbd542c96c701a1cd58b1c89b89da04d9c175e9ccde70da27c92e073e570138dd1

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DFS.adml

    • Size

      1KB

    • MD5

      59649458234fa8ec0fa1ccf6d1a1f000

    • SHA1

      fa84dc8c633ac66d93c2cc4ca82973690cc01b06

    • SHA256

      7c621bdfa9aafbb72c6e3eaa6bd9dadb9b87b76ff3085c3ab85f94a4ba74148b

    • SHA512

      3dac7345cdf6e474ec6550890d2581e97ceccbdf3d6da446d0b4051600b81e66725e20e3905fc8ed051e00ae74b7899ecec073c828e776fb664731218f88e528

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DWM.adml

    • Size

      4KB

    • MD5

      8c0c1f2ac3237b8aa71f88a5650c0e68

    • SHA1

      8a39fc535339841cc7573b1dcff729cec8e54114

    • SHA256

      844bf77e54e0c353537b0d1349f0173049dd36c0cb64eaee900663cd0a227ab4

    • SHA512

      c6f8ac395d011ec45ebf47812ebebf7e152db6a943566b744aa83b22529df07e3d0749d008b5f3a8a46953cccf39305966869e5efe502b1e727cf55ed7a05f4f

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DeviceCompat.adml

    • Size

      1012B

    • MD5

      8c5bfc23602cf18e6ec73bdf468c5c65

    • SHA1

      87c49103ecb11f3284de1311d305ce426da77573

    • SHA256

      5fe3fc627dfaeddeddd5c617d4ddd1ab367353a97026268c27ab45b8a9025472

    • SHA512

      ed4bf6b6d7f2f5b248df14daa85551613583e8dcfd734266e08296f0dcb52055a2cad56c23ddfa20ea3315a9dd3b3d538ee673c89e97cfc8d5d9be39bb575794

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DeviceInstallation.adml

    • Size

      20KB

    • MD5

      b0d80e37838946a958789511d6090800

    • SHA1

      e80ebc94d870b40e9925d9473e83438287a3df50

    • SHA256

      ead0368b0ab7404addc0b8bd016e04d43c7a1e370a2875a6785863a53cc94095

    • SHA512

      a13d7aa56fa39803b8cb441dd6907a0f06e2b89eb478b6c6d57687f0e154de44ef959411627c33d5652d096e439f6518c624a4f159189c8da7ad51370fb12ad3

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DeviceSetup.adml

    • Size

      8KB

    • MD5

      9e7c326dccfd5bdae53f0ff7359042cf

    • SHA1

      bfc33d23a42406ef057ac21bceca4310c256c901

    • SHA256

      4e1bc9fda548eebf29a499b61ce0462983dd461db84f4b2c63150636b917036b

    • SHA512

      96c937f5f6871d7bd0f3fdf0b6d502232c29c6e77de7b1fd0a79db4adbc7eaafbc0a60c76c8af6d5d85ca7397a4c995be385320c64d23076a7658c1b1187a624

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DigitalLocker.adml

    • Size

      1KB

    • MD5

      a4eeca9fc18fd2f595ecc98fd40e0f5f

    • SHA1

      efbab95f94c418be4b025f3ca14ba3441c1d7ce8

    • SHA256

      348b0a60bca267759ca52611c67b06ab3347cab23786c257d984eb7f3f94c6a2

    • SHA512

      11a2fb546e64ca105ce63e313fcdde0950939c5981beec4d04ceb0c0c43eb573cc3c5444e71bbd12ad04a902cb4d3fc7c41eb4e9ba601232041716cee0835622

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DiskDiagnostic.adml

    • Size

      3KB

    • MD5

      98fb5567e5194e5e7430c553fd07ee50

    • SHA1

      9cd9de9b3e9fad928dcbb73225b7f77b21d7f532

    • SHA256

      3ee2d33b8c14490d4315f669873b1e4747ef4c99cf83cb3214fbe02774df322d

    • SHA512

      2dc8749cb1e401e4a7753933861081d80ab9d11d349730289e36fd59ef3f76cfce63ac71864b7239c05cfad12f89d7991f1aa79e78751f926a941f82eadd23c3

    Score
    1/10
    • Target

      Document.pdf/App Settings/en-US/DiskNVCache.adml

    • Size

      4KB

    • MD5

      74ff3350ef82b0e11ef64c762cf28be3

    • SHA1

      8d7bb871cc583eb03e3e104fdc50fcbc974527eb

    • SHA256

      d94738c802a64bda9cca3947096a97b4dac05730bd55441ed552595422103a9f

    • SHA512

      0729601ad1e861f7da3e39ecc3878a37afa3e37c92924446b28fa6bdfb4189d024b7f4e5ce0bf29fe4eb3b51dfa98fe07b7a560ddc521fbdab4e50ea6c6160c2

    Score
    1/10
    • Target

      Document.pdf/Document.pdf.scr

    • Size

      700.0MB

    • MD5

      ea7b8236ca438995b2ee7604043fc20c

    • SHA1

      4543d6fbe467c8a17b962e0c19a25fd59d82ded8

    • SHA256

      954e35d28e5938766eb6922e08a4e26d5ed892a1578027374d945efbe0d927e3

    • SHA512

      22a1173def10e7c74fbcef024127f87635a508044c4fbbfa2f4e32b05823b5fc9fa166645851dbaa32c926a735745ca727dc0183a72fd9f3cc222f9f07395a7a

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

31
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks

static1

Score
N/A

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

redline1infostealerspyware
Score
10/10