Overview

overview

10

Static

static

1a.scr.exe

windows7-x64

10

1a.scr.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a.scr.exe

  • Size

    1.9MB

  • Sample

    221109-tfrw3abfhk

  • MD5

    ce4239c21519dfdba465c6f325e9a637

  • SHA1

    c0c4a4600284dd8320e2bda24d4d3fc3bd1ea4d8

  • SHA256

    464640bb9eaea6dd08a6ccc40be701f172f9d7785cf1e16f8e4dffcda413cb79

  • SHA512

    eb16e474e307c83dc0447d40bb6e3e59570eeab8994b2d82c0b2e708531c7ca672b4f6ca27618958eda00cb2cdd8dfa6032e9878f0d2874491235f9fb8c15cb2

  • SSDEEP

    24576:Mwja/MSWzFgC5V3h2wsa2pUjQG7vEI+EfWs8AzWjZjLnhusYr0Nrrml+9Cfk8VKm:f3vPhlJlcPh6crrmhM8V+5

Score
10/10
redline7discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

7

C2

185.112.83.147:17431

Attributes
  • auth_value

    a9c634096a685c3e7d2247c07b4a547b

Targets

    • Target

      1a.scr.exe

    • Size

      1.9MB

    • MD5

      ce4239c21519dfdba465c6f325e9a637

    • SHA1

      c0c4a4600284dd8320e2bda24d4d3fc3bd1ea4d8

    • SHA256

      464640bb9eaea6dd08a6ccc40be701f172f9d7785cf1e16f8e4dffcda413cb79

    • SHA512

      eb16e474e307c83dc0447d40bb6e3e59570eeab8994b2d82c0b2e708531c7ca672b4f6ca27618958eda00cb2cdd8dfa6032e9878f0d2874491235f9fb8c15cb2

    • SSDEEP

      24576:Mwja/MSWzFgC5V3h2wsa2pUjQG7vEI+EfWs8AzWjZjLnhusYr0Nrrml+9Cfk8VKm:f3vPhlJlcPh6crrmhM8V+5

    Score
    10/10
    redline7discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks