Overview

overview

10

Static

static

watchdog.exe

windows7-x64

10

watchdog.exe

windows10-2004-x64

10

Resubmissions

18-10-2022 23:58

221018-3z77tsegfl 10

18-10-2022 23:33

221018-3j1g2sebb7 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    watchdog.exe

  • Size

    2.5MB

  • Sample

    221018-3z77tsegfl

  • MD5

    d3ac977c3116f7fa46440c49442530e1

  • SHA1

    0476c3a527c6fcbd399dedaa4333cbff9980c36b

  • SHA256

    71bb05f9456d694a82791671217934c63f5cf3a40d0141fe03e2428396a1f2bb

  • SHA512

    2c4561770d85b1d78bfc56cf79906f515b8b35c29fb98300298a5b47510f3c5666c5177eb9c29d616fcf80538216ce33c296dd1fc9716c1ea433a62a2e4705fb

  • SSDEEP

    24576:l8DI1TLpJMyOb8YJYBhJ2XvMYc66hd0/P5ErlbCUuwZUNl/W2iK/8HHLpMu79dh8:l8DiXpJ7ON0bCUjZUNpW2p/8HHWsHl3C

Score
10/10
redline875784825infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

875784825

C2

79.137.192.6:8362

Targets

    • Target

      watchdog.exe

    • Size

      2.5MB

    • MD5

      d3ac977c3116f7fa46440c49442530e1

    • SHA1

      0476c3a527c6fcbd399dedaa4333cbff9980c36b

    • SHA256

      71bb05f9456d694a82791671217934c63f5cf3a40d0141fe03e2428396a1f2bb

    • SHA512

      2c4561770d85b1d78bfc56cf79906f515b8b35c29fb98300298a5b47510f3c5666c5177eb9c29d616fcf80538216ce33c296dd1fc9716c1ea433a62a2e4705fb

    • SSDEEP

      24576:l8DI1TLpJMyOb8YJYBhJ2XvMYc66hd0/P5ErlbCUuwZUNl/W2iK/8HHLpMu79dh8:l8DiXpJ7ON0bCUjZUNpW2p/8HHWsHl3C

    Score
    10/10
    redline875784825infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks