Overview

overview

10

Static

static

022feda4ff...c1.exe

windows7-x64

10

022feda4ff...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    022feda4ffeb1c66fad4f21f32d87fc1.exe

  • Size

    170KB

  • Sample

    221129-kbvygsfb41

  • MD5

    022feda4ffeb1c66fad4f21f32d87fc1

  • SHA1

    b40adfd3e749808f49b8b836de225e30504cb6bd

  • SHA256

    5aef4df96a2d51eae5682031b18e9c960df50d85840c0f6ea8e9911219226fe1

  • SHA512

    0e62f3f7c9a2b808fc60ee9b36e7ac3ed62173f5d91377344fd83102458a66b7fda95a062569944be0f64a5df55138ee2b61508e6c8c7f7cb739d3cbf52e99e7

  • SSDEEP

    3072:hlzJ/tPhhE+6m9pmVQ+7ybzgadwNyv3HxKsAX46jy3Bphr7l:hlLQ+6m9pj+COyvxKr+

Score
10/10
redline5121940512_99infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

5121940512_99

C2

soccerschoolio.xyz:3306

soccerschoolio.xyz:28786
Attributes
  • auth_value

    b2bd789e382f723abb14d658fc457e8f

Targets

    • Target

      022feda4ffeb1c66fad4f21f32d87fc1.exe

    • Size

      170KB

    • MD5

      022feda4ffeb1c66fad4f21f32d87fc1

    • SHA1

      b40adfd3e749808f49b8b836de225e30504cb6bd

    • SHA256

      5aef4df96a2d51eae5682031b18e9c960df50d85840c0f6ea8e9911219226fe1

    • SHA512

      0e62f3f7c9a2b808fc60ee9b36e7ac3ed62173f5d91377344fd83102458a66b7fda95a062569944be0f64a5df55138ee2b61508e6c8c7f7cb739d3cbf52e99e7

    • SSDEEP

      3072:hlzJ/tPhhE+6m9pmVQ+7ybzgadwNyv3HxKsAX46jy3Bphr7l:hlLQ+6m9pj+COyvxKr+

    Score
    10/10
    redline5121940512_99infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks