Overview

overview

10

Static

static

505509de0e...f1.exe

windows7-x64

10

505509de0e...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    505509de0eccbd99559118cc90f42f5618c68827d963394afdef810c7fc3b2f1

  • Size

    184KB

  • Sample

    221225-xdqg1afb3v

  • MD5

    5a5ac6eea5b7f08143f8b13a8c9a63fb

  • SHA1

    00b6062ad76813eaa113b654b223448dc543c16f

  • SHA256

    f077bc5ba32978adcbf73783c53a0cc4ab0e2047018253317b81327f6bc3412c

  • SHA512

    9debe446a58b96904b55621d98ddaddefe6497e4d287fe1cdb664fd6cfcfdbb7402cec9c5d4aa38fac5fef307234f50483d1e553c2884c13cadefc22bf85858a

  • SSDEEP

    3072:bDHJflUXx4+6cHzXzxRV/k+xhJL3LR+3nXva5J6fjWU5vH+QQ6PW5/Wp+L:Rdqx4cXdr8+xhNqnXva5qjWmvy6Cu8L

Score
10/10
redline11infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

11

C2

79.137.202.18:45218

Attributes
  • auth_value

    107e09eee63158d2488feb03dac75204

Targets

    • Target

      505509de0eccbd99559118cc90f42f5618c68827d963394afdef810c7fc3b2f1

    • Size

      399KB

    • MD5

      0ea45bddb097b50c089bea5ae3f5a6fd

    • SHA1

      4a9755d1e363803087d8f2c77d2c3cc5804196e2

    • SHA256

      505509de0eccbd99559118cc90f42f5618c68827d963394afdef810c7fc3b2f1

    • SHA512

      f70607e01a2b8fa2d60f54cace041ed12a3610d94f4e30f84b5b7cc7b48ae1c7725eb8aa69ea2aa5d3261bd772d239a7792c7817a0aac46e3e5702cb0184aad5

    • SSDEEP

      6144:p6DCxLT52vMishn5u9OC9ZjYAOkuXFGvNCy7QRO8GjTKXe/kXDN:p6DCxLT52vMiy7yuVfRO/TWN

    Score
    10/10
    redline11infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks