Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    334KB

  • Sample

    221216-w6ltvafc56

  • MD5

    4569f81ad725c65ab4ce8c6bb4adde58

  • SHA1

    e0290ecc4fa208719967115560bd4f5e6854ca12

  • SHA256

    6acde2d4a9ae84d6772ccc4c8f027e72e735b7a1665624fbce6bd1f3ddc62c16

  • SHA512

    9ad103fe97fd1f6c8f76c26380765d2c009e29946926e06300f81db5640d85b55fda0db0a771c4b6726732f1cb36260ae0373d6b226c0bb390f682abde5486f9

  • SSDEEP

    6144:k6ML+HAtMUPIP5mM8+l41tOZbykYAhnf7gK6Kg9TjBfbgzH440M2b:k6M0IIP5mssOsjcR6Kg5jtU

Score
10/10
redline@2023@discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

C2

193.106.191.138:32796

Attributes
  • auth_value

    ca057e5baadfd0774a34a6a949cd5e69

Targets

    • Target

      file.exe

    • Size

      334KB

    • MD5

      4569f81ad725c65ab4ce8c6bb4adde58

    • SHA1

      e0290ecc4fa208719967115560bd4f5e6854ca12

    • SHA256

      6acde2d4a9ae84d6772ccc4c8f027e72e735b7a1665624fbce6bd1f3ddc62c16

    • SHA512

      9ad103fe97fd1f6c8f76c26380765d2c009e29946926e06300f81db5640d85b55fda0db0a771c4b6726732f1cb36260ae0373d6b226c0bb390f682abde5486f9

    • SSDEEP

      6144:k6ML+HAtMUPIP5mM8+l41tOZbykYAhnf7gK6Kg9TjBfbgzH440M2b:k6M0IIP5mssOsjcR6Kg5jtU

    Score
    10/10
    redline@2023@discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks