Overview

overview

10

Static

static

376cfa74d8...c8.exe

windows7-x64

10

376cfa74d8...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    376cfa74d8a65fb5836828c55cfd8fc8.exe

  • Size

    398KB

  • Sample

    221225-jrj1gsed6s

  • MD5

    376cfa74d8a65fb5836828c55cfd8fc8

  • SHA1

    351c94238b50a6b3fbfb1ad538b6b2afa87b4dfa

  • SHA256

    99b7396773e11d0a1d44f674310025344f2d8c9d2813d33e9bd7dd35ac5f2360

  • SHA512

    5faef6a465e5c3ae6da08c7191942feb6967557b78ca4d2d613957245dcfa6eeb08eaf573a20e04f1a61b6cf926223ecd9fae3ecb2b2e9f614647e466b774e73

  • SSDEEP

    6144:Wygxer6dluLigEBBY2o1FhZRVPjGAOngeijc+/B9IVmoGP7:Wygxer6dluLigEZoNZaJOf9OQP7

Score
10/10
redline11infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

11

C2

79.137.202.18:45218

Attributes
  • auth_value

    107e09eee63158d2488feb03dac75204

Targets

    • Target

      376cfa74d8a65fb5836828c55cfd8fc8.exe

    • Size

      398KB

    • MD5

      376cfa74d8a65fb5836828c55cfd8fc8

    • SHA1

      351c94238b50a6b3fbfb1ad538b6b2afa87b4dfa

    • SHA256

      99b7396773e11d0a1d44f674310025344f2d8c9d2813d33e9bd7dd35ac5f2360

    • SHA512

      5faef6a465e5c3ae6da08c7191942feb6967557b78ca4d2d613957245dcfa6eeb08eaf573a20e04f1a61b6cf926223ecd9fae3ecb2b2e9f614647e466b774e73

    • SSDEEP

      6144:Wygxer6dluLigEBBY2o1FhZRVPjGAOngeijc+/B9IVmoGP7:Wygxer6dluLigEZoNZaJOf9OQP7

    Score
    10/10
    redline11infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks