Overview

overview

10

Static

static

8

D4E46DED5B...15.exe

windows7-x64

10

D4E46DED5B...15.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exe

  • Size

    3.5MB

  • Sample

    220806-mghw8adfcl

  • MD5

    9ce5f14b8594d39723d696d393ed5cd5

  • SHA1

    920a12bb0dce60d81d9b149a5d8fb8e7893ffd56

  • SHA256

    d4e46ded5bca4a7086100e2296e9f434d357af08cc5153091834f0b6969133f6

  • SHA512

    b0652648aa7b94764be0f27a4941680c6a7ba12b367713e2aac149be1ccd572ecaf1deca6d637e23f4995c04b636d240445f849bbc7bae7ffd6b3b441e7b1be6

Score
10/10
redline3discoveryinfostealerspywarestealervmprotect

Malware Config

Extracted

Family

redline

Botnet

3

C2

95.217.188.140:33503

Attributes
  • auth_value

    a34cc5e78c548506cf8a16e5ac230fff

Targets

    • Target

      D4E46DED5BCA4A7086100E2296E9F434D357AF08CC515.exe

    • Size

      3.5MB

    • MD5

      9ce5f14b8594d39723d696d393ed5cd5

    • SHA1

      920a12bb0dce60d81d9b149a5d8fb8e7893ffd56

    • SHA256

      d4e46ded5bca4a7086100e2296e9f434d357af08cc5153091834f0b6969133f6

    • SHA512

      b0652648aa7b94764be0f27a4941680c6a7ba12b367713e2aac149be1ccd572ecaf1deca6d637e23f4995c04b636d240445f849bbc7bae7ffd6b3b441e7b1be6

    Score
    10/10
    redline3discoveryinfostealervmprotectspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks