Overview

overview

10

Static

static

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca

  • Size

    336KB

  • Sample

    230202-eks8csgf8s

  • MD5

    038622c6279b62272933d5e86e1056bb

  • SHA1

    d924ada192f407478ff86a2f826783ab92598f96

  • SHA256

    303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca

  • SHA512

    c818dac7d5f41df16df20d798310287f1e815d9ddf306d9c2e84b8c20decd33a6d47ef22737882d0c607aade28cd3d1a1bf749a4069c7a01c3552abfce245946

  • SSDEEP

    6144:JtYrfgLSe3HNS03+/m3zSJ+TFIzu2s1pG95aGJrzqXK:JtYkGe3HNBzDSETFz2vrz1

Score
10/10
redlinemilafdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

milaf

C2

193.233.20.5:4136

Attributes
  • auth_value

    68aaee25afe3d0ae7d4db09dea02347c

Targets

    • Target

      303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca

    • Size

      336KB

    • MD5

      038622c6279b62272933d5e86e1056bb

    • SHA1

      d924ada192f407478ff86a2f826783ab92598f96

    • SHA256

      303262122fa39fdf8381e625e4def3bbb70a08f6ace6f8da04449438c606a3ca

    • SHA512

      c818dac7d5f41df16df20d798310287f1e815d9ddf306d9c2e84b8c20decd33a6d47ef22737882d0c607aade28cd3d1a1bf749a4069c7a01c3552abfce245946

    • SSDEEP

      6144:JtYrfgLSe3HNS03+/m3zSJ+TFIzu2s1pG95aGJrzqXK:JtYkGe3HNBzDSETFz2vrz1

    Score
    10/10
    redlinemilafdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks