Overview

overview

10

Static

static

1

LDPlayer9....ld.exe

windows7-x64

10

LDPlayer9....ld.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LDPlayer9.0_es_1260_ld.exe

  • Size

    601.3MB

  • Sample

    230228-f1bhxshe4w

  • MD5

    1eeabc6eec8b0bb07b62a00d8bd7d62e

  • SHA1

    6a07c523c4528a64868945e882faba516a0f772c

  • SHA256

    8cdd13b91d01a6bf4fcb2465cd14e8427c4e38232726ee3481601d2c645d75e7

  • SHA512

    29594e66cd8c631a0128c4d9a84c4e523ee7bc66fbeb3dbcabfe6ddef2d5c6cd400ddf2bc36ba1a4c05625d52768a1082af96bcfffe4eecca09d54dc7ec439aa

  • SSDEEP

    12582912:kMYOUb/fhhqe2hPmWVsLJV6FObSZBshtzycWRTtc2RNctGwZeP:1G/fhEe2BGpSs32ztRNctDUP

Score
10/10
gafgytplugxredlinebotnetdiscoveryexploitinfostealerpersistencetrojan

Malware Config

Targets

    • Target

      LDPlayer9.0_es_1260_ld.exe

    • Size

      601.3MB

    • MD5

      1eeabc6eec8b0bb07b62a00d8bd7d62e

    • SHA1

      6a07c523c4528a64868945e882faba516a0f772c

    • SHA256

      8cdd13b91d01a6bf4fcb2465cd14e8427c4e38232726ee3481601d2c645d75e7

    • SHA512

      29594e66cd8c631a0128c4d9a84c4e523ee7bc66fbeb3dbcabfe6ddef2d5c6cd400ddf2bc36ba1a4c05625d52768a1082af96bcfffe4eecca09d54dc7ec439aa

    • SSDEEP

      12582912:kMYOUb/fhhqe2hPmWVsLJV6FObSZBshtzycWRTtc2RNctGwZeP:1G/fhEe2BGpSs32ztRNctDUP

    Score
    10/10
    redlinediscoveryexploitinfostealerpersistencegafgytplugxbotnettrojan

    • Detected Gafgyt variant

    • Detects PlugX payload

    • Gafgyt/Bashlite

      IoT botnet with numerous variants first seen in 2014.

      botnetgafgyt

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Creates new service(s)

      persistence

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks