Overview

overview

10

Static

static

1

00cbdba9d1...7a.exe

windows7-x64

10

00cbdba9d1...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00cbdba9d104e9f41a9906035e680fd13ddd24f6d53ddc952b6e41ad7c4aaf7a.bin

  • Size

    716KB

  • Sample

    230311-257yksbg89

  • MD5

    1414e96643542204aa27d91584f47f25

  • SHA1

    99e37f106435c0f089a6afa36752cd80d406be3c

  • SHA256

    00cbdba9d104e9f41a9906035e680fd13ddd24f6d53ddc952b6e41ad7c4aaf7a

  • SHA512

    d90d326a05296d95da9a13051e2e16f4053b930993bd1d5227ae47f49f3d282ba6edc3600ef7d5acb5b7b252e1113fe5f840fbda396fc6f4bf766c5bf05de1bb

  • SSDEEP

    12288:WMrGy90yLnpAizNQmzbMaag9MU8u2qeNre4pP8xD+4yhL6NEvBHtp33SaX:YyfGxo8nNFp0xDWGEpB

Score
10/10
redlinefudevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Targets

    • Target

      00cbdba9d104e9f41a9906035e680fd13ddd24f6d53ddc952b6e41ad7c4aaf7a.bin

    • Size

      716KB

    • MD5

      1414e96643542204aa27d91584f47f25

    • SHA1

      99e37f106435c0f089a6afa36752cd80d406be3c

    • SHA256

      00cbdba9d104e9f41a9906035e680fd13ddd24f6d53ddc952b6e41ad7c4aaf7a

    • SHA512

      d90d326a05296d95da9a13051e2e16f4053b930993bd1d5227ae47f49f3d282ba6edc3600ef7d5acb5b7b252e1113fe5f840fbda396fc6f4bf766c5bf05de1bb

    • SSDEEP

      12288:WMrGy90yLnpAizNQmzbMaag9MU8u2qeNre4pP8xD+4yhL6NEvBHtp33SaX:YyfGxo8nNFp0xDWGEpB

    Score
    10/10
    redlinefudevasioninfostealerpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks