Overview

overview

10

Static

static

Attachment.js

windows7-x64

10

Attachment.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Attachment.js

  • Size

    16KB

  • Sample

    221129-l7lkcshf67

  • MD5

    a5e53490de507ad38f48feb3944ea8f1

  • SHA1

    db5d2cb363c4bcb8ed2406cb3ba7328fae62aece

  • SHA256

    2f71c2aca595dca2830cd5ecb4927e3a5f8502637929ca874165ccf1997f896f

  • SHA512

    381419f42b75dc4149c1b9a10bf414ff9599290c949280e34c2c4e347af3a514aefa284670a177dcf997b693115e4cfe5ccc9e8fd97c977930a3bc112ba41a97

  • SSDEEP

    384:NKmR3PfU2qCzuB01e8WuheOaEo/DuQy4W3KieZaEqO3aLfxk3l:NKmFf5xDJcOO6QoRCqO39

Score
10/10
redlinevjw0rmappdiscoveryinfostealerspywarestealertrojanworm

Malware Config

Extracted

Family

redline

Botnet

APP

C2

37.139.128.51:53092

Targets

    • Target

      Attachment.js

    • Size

      16KB

    • MD5

      a5e53490de507ad38f48feb3944ea8f1

    • SHA1

      db5d2cb363c4bcb8ed2406cb3ba7328fae62aece

    • SHA256

      2f71c2aca595dca2830cd5ecb4927e3a5f8502637929ca874165ccf1997f896f

    • SHA512

      381419f42b75dc4149c1b9a10bf414ff9599290c949280e34c2c4e347af3a514aefa284670a177dcf997b693115e4cfe5ccc9e8fd97c977930a3bc112ba41a97

    • SSDEEP

      384:NKmR3PfU2qCzuB01e8WuheOaEo/DuQy4W3KieZaEqO3aLfxk3l:NKmFf5xDJcOO6QoRCqO39

    Score
    10/10
    redlinevjw0rmappdiscoveryinfostealerspywarestealertrojanworm

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

      trojanwormvjw0rm

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks