Overview

overview

10

Static

static

10

a1fe952004...a1.exe

windows7-x64

10

a1fe952004...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1fe952004f21dad2b69227159d220a1.exe

  • Size

    95KB

  • Sample

    230129-kbjv8afe63

  • MD5

    a1fe952004f21dad2b69227159d220a1

  • SHA1

    90bb6a2a48a1eadb0dc9bf4a9c3bfd0a4c09b5d2

  • SHA256

    a6ffb52825c97bed3a97c6cea3d3598fa1be09c373b15230a115db861f3642b7

  • SHA512

    848b78c693ea1e7cb9efc70e72db5c93bb663a2e8b786bdeaf86509f0bd3fe77d1cfed017c316b13b973541b9c559caef82cedc4462425ac7412d825ef44c6a0

  • SSDEEP

    1536:5qs8OqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2Bv3teulgS6p8l:XHuOYj+zi0ZbYe1g0ujyzdgw8

Score
10/10
redlinecheatdiscoveryinfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

104.234.118.178:63242

Targets

    • Target

      a1fe952004f21dad2b69227159d220a1.exe

    • Size

      95KB

    • MD5

      a1fe952004f21dad2b69227159d220a1

    • SHA1

      90bb6a2a48a1eadb0dc9bf4a9c3bfd0a4c09b5d2

    • SHA256

      a6ffb52825c97bed3a97c6cea3d3598fa1be09c373b15230a115db861f3642b7

    • SHA512

      848b78c693ea1e7cb9efc70e72db5c93bb663a2e8b786bdeaf86509f0bd3fe77d1cfed017c316b13b973541b9c559caef82cedc4462425ac7412d825ef44c6a0

    • SSDEEP

      1536:5qs8OqJGlbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2Bv3teulgS6p8l:XHuOYj+zi0ZbYe1g0ujyzdgw8

    Score
    10/10
    redlinecheatdiscoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks