Overview

overview

10

Static

static

winprofile

windows7-x64

1

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4

  • Size

    1.2MB

  • Sample

    221118-ebw8nace3w

  • MD5

    49128d358b90e7110e9f792e247d1db2

  • SHA1

    da15de46c60bafa8493f3ebf65c6455230c0f7fb

  • SHA256

    4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4

  • SHA512

    1f524959ef6788adf7da27c2fc847d15b404e740d56f9e92f388e23070f6bb0c8881c08e114590a966d4a0240368bd9dbd423318eac86935845fa85def0bfce4

  • SSDEEP

    24576:AyTsIIQSREBz3op/xkIQKHmQGtaduEKq4:AyHSRLxkhVQGyhKq

Score
10/10
redlineramsesinfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

RAMSES

C2

77.73.134.54:19123

Attributes
  • auth_value

    3ba0ecb99f540fa197be387c2d886b1f

Targets

    • Target

      4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4

    • Size

      1.2MB

    • MD5

      49128d358b90e7110e9f792e247d1db2

    • SHA1

      da15de46c60bafa8493f3ebf65c6455230c0f7fb

    • SHA256

      4d9ca052a45d3b3cf3f995c5e070532f38c8c6f8817b8f008b7820b5d25152a4

    • SHA512

      1f524959ef6788adf7da27c2fc847d15b404e740d56f9e92f388e23070f6bb0c8881c08e114590a966d4a0240368bd9dbd423318eac86935845fa85def0bfce4

    • SSDEEP

      24576:AyTsIIQSREBz3op/xkIQKHmQGtaduEKq4:AyHSRLxkhVQGyhKq

    Score
    10/10
    redlineramsesinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks