Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Resubmissions

08/03/2023, 04:02

230308-el2acsdh6510

08/03/2023, 03:53

230308-ef443adh3210

Sharing

Copy URL Twitter E-mail

General

  • Target
    10d5b999c6a1d09f32c72905ee478b23cf3eb01a96aa010395357579330aa08f
  • Size 6.0MB
  • Sample230308-ef443adh32
  • SHA256 10d5b999c6a1d09f32c72905ee478b23cf3eb01a96aa010395357579330aa08f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
redlinevidar1infostealerspywarestealer

Malware Config

Extracted

Family

  • redline

Botnet

  • 1

C2

  • 176.113.115.220:80

Attributes
  • auth_value

    b6c86adb7106e9ee7247628f59e06830

Targets

    • Target
      10d5b999c6a1d09f32c72905ee478b23cf3eb01a96aa010395357579330aa08f
    • Size 6.0MB
    • SHA256 10d5b999c6a1d09f32c72905ee478b23cf3eb01a96aa010395357579330aa08f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    redlinevidarinfostealerstealer1spyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Loads dropped DLL

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks