Overview

overview

10

Static

static

10

478c8b8269...de.exe

windows7-x64

10

478c8b8269...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    478c8b8269a564c956bd038a005026de.exe

  • Size

    359KB

  • Sample

    221003-klfljsfed5

  • MD5

    478c8b8269a564c956bd038a005026de

  • SHA1

    9c0463608cfa143bc75fb4755f755e0169951c7c

  • SHA256

    ebb74e1bc458746c7dce4ddc80718e68204fd6f4eaced12b09b62aba16f981c0

  • SHA512

    1e2a3cc7eeeb0bf2b4ec635d2e9345c1d34ba29d9f1e02ef8a3d7c15f7979089257a790ecef6b970c727d0817257309e23e301969ddef7944a7c746ea159dcc2

  • SSDEEP

    6144:YAxtoIrF8coV6rlhEIDgT8Yyt1p5u8JQi+Z7MhXLcsGVYZsMyRYiuDrfjx3PDyy0:XtpSnQR+IDgAX5BJQi+Z7MhXLcsGVYZU

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

C2

65.108.247.147:37767

Attributes
  • auth_value

    6a82f1fb90afb278c299e83d46279927

Targets

    • Target

      478c8b8269a564c956bd038a005026de.exe

    • Size

      359KB

    • MD5

      478c8b8269a564c956bd038a005026de

    • SHA1

      9c0463608cfa143bc75fb4755f755e0169951c7c

    • SHA256

      ebb74e1bc458746c7dce4ddc80718e68204fd6f4eaced12b09b62aba16f981c0

    • SHA512

      1e2a3cc7eeeb0bf2b4ec635d2e9345c1d34ba29d9f1e02ef8a3d7c15f7979089257a790ecef6b970c727d0817257309e23e301969ddef7944a7c746ea159dcc2

    • SSDEEP

      6144:YAxtoIrF8coV6rlhEIDgT8Yyt1p5u8JQi+Z7MhXLcsGVYZsMyRYiuDrfjx3PDyy0:XtpSnQR+IDgAX5BJQi+Z7MhXLcsGVYZU

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks