Overview

overview

10

Static

static

mоdеst-mеnu.exe

windows7-x64

10

mоdеst-mеnu.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mоdеst-mеnu.exe

  • Size

    2.6MB

  • Sample

    221107-fylwwaceep

  • MD5

    a5c547265ed07c915d1988ee7f44a14a

  • SHA1

    593d43959ba2ec563adc948d1b26181752e10bbb

  • SHA256

    09f06431e9f721b193e24d6b2d61f415a6ee6e4e42b141dcaf30223cf162d993

  • SHA512

    b3559e12540f6358840731652fe87bb05cf758555407bd9b93ce05e2158303facc8ea3cab04606bcbcce0c5905bd582ea3180e59741435b4daae4fca448ed504

  • SSDEEP

    24576:ZHH7JxKgNhQuH8gG3APGGK/cRgOnmq9g6Nsp02P4goxZl3RuQ55313:BHFxrHH8gqGScOU7m6Nc0Ll3

Score
10/10
redline@cham1nginfostealer

Malware Config

Extracted

Family

redline

Botnet

@cham1ng

C2

193.106.191.160:8673

Attributes
  • auth_value

    296c18e34d670ae41d67c9e09e2546b7

Targets

    • Target

      mоdеst-mеnu.exe

    • Size

      2.6MB

    • MD5

      a5c547265ed07c915d1988ee7f44a14a

    • SHA1

      593d43959ba2ec563adc948d1b26181752e10bbb

    • SHA256

      09f06431e9f721b193e24d6b2d61f415a6ee6e4e42b141dcaf30223cf162d993

    • SHA512

      b3559e12540f6358840731652fe87bb05cf758555407bd9b93ce05e2158303facc8ea3cab04606bcbcce0c5905bd582ea3180e59741435b4daae4fca448ed504

    • SSDEEP

      24576:ZHH7JxKgNhQuH8gG3APGGK/cRgOnmq9g6Nsp02P4goxZl3RuQ55313:BHFxrHH8gqGScOU7m6Nc0Ll3

    Score
    10/10
    redline@cham1nginfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks