Overview

overview

10

Static

static

55b1fd7484...94.exe

windows7-x64

10

55b1fd7484...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    55b1fd7484074158f9e9e8f657ec5a94.exe

  • Size

    385KB

  • Sample

    221121-sfk8vaef97

  • MD5

    55b1fd7484074158f9e9e8f657ec5a94

  • SHA1

    6988125039cbf77b4ff06fa75fa56975004d3333

  • SHA256

    92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22

  • SHA512

    a7b292cc74578308b4c3d129809119a96c6522185e05ddaefb294ae6636894a145383140d23b1d3217f300ee63646d6f185fdb02dcbd9ab0ee5d840aa49b4de9

  • SSDEEP

    12288:3fW6EQ0byZvdEnOuX9opfM99K0S+pOxOTEh25D:3fCbyZvdEnFX9op2KQKdhA

Score
10/10
redlinetop1discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

top1

C2

chardhesha.xyz:81

jalocliche.xyz:81
Attributes
  • auth_value

    fa2afa98a6579319e36e31ee0552bd57

Targets

    • Target

      55b1fd7484074158f9e9e8f657ec5a94.exe

    • Size

      385KB

    • MD5

      55b1fd7484074158f9e9e8f657ec5a94

    • SHA1

      6988125039cbf77b4ff06fa75fa56975004d3333

    • SHA256

      92d305d4c7faa7d3d004a7c535d289235b187c4f72a97e76736f6fcd3fdbac22

    • SHA512

      a7b292cc74578308b4c3d129809119a96c6522185e05ddaefb294ae6636894a145383140d23b1d3217f300ee63646d6f185fdb02dcbd9ab0ee5d840aa49b4de9

    • SSDEEP

      12288:3fW6EQ0byZvdEnOuX9opfM99K0S+pOxOTEh25D:3fCbyZvdEnFX9op2KQKdhA

    Score
    10/10
    redlinetop1discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks