Overview

overview

10

Static

static

80d0a906e9...32.exe

windows7-x64

10

80d0a906e9...32.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80d0a906e9436cc01a249a25bf4a21c94e4bc3a7c3789532b3e5f102e4351f32

  • Size

    272KB

  • Sample

    220812-a2mppaggh5

  • MD5

    bcb82e1ed1ecff1715e9d64e444ed59b

  • SHA1

    cb02721866b88b1d3f2d444f0c6d893ba49fc178

  • SHA256

    77e127475b94902186e67e6813a2904a71d1896b720e79e875678087e2d4490e

  • SHA512

    c7f5ea3843c089094aa3dad19637a660ee15286b28794dbc102cc8d2af567f267da4e1512eca0b563aade47af35a4f5c014682ddb5d43bb0f8cbc4e9b1c33213

Score
10/10
redlineruzkidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

ruzki

C2

193.106.191.165:39482

Attributes
  • auth_value

    71a0558c0eea274a5bd617ea85786884

Targets

    • Target

      80d0a906e9436cc01a249a25bf4a21c94e4bc3a7c3789532b3e5f102e4351f32

    • Size

      352KB

    • MD5

      d2132025c63d7b2b6b3ceac801330937

    • SHA1

      5bf0b779bf733cf55857a757894ca232aadf6459

    • SHA256

      80d0a906e9436cc01a249a25bf4a21c94e4bc3a7c3789532b3e5f102e4351f32

    • SHA512

      1917c4ee1fdded302473cf4f2751d1d6f505e7382dc9dedad881aef8d9d40ea18786d25e59a3c7225570a8a31f2cb65b05f8899e8b1c67203ad7c60b82b7129d

    Score
    10/10
    redlineruzkidiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks