Malware sandboxing report by Hatching Triage

Sharing

Copy URL

Twitter E-mail

General

Target

625a6e5301d0160f38945cff9a8338838461d5f3e2f3fe2bf1b3b35536f6baee
Size

851KB
Sample

230319-ckfadsge61
MD5

2253bd37a78f6c6022986a3fbeeedfd2
SHA1

27ada82b4dbae9e5359f6762bc5d293aeb81ff11
SHA256

625a6e5301d0160f38945cff9a8338838461d5f3e2f3fe2bf1b3b35536f6baee
SHA512

884cc1feb1d987da5e065b6bed6c66ca2cc766e36f32f5ce04716608aebf6cc872af0d050cd3c1db1810a30e2bcf8ddd42a1fbbd3e734c903de3cdc3db43dd3c
SSDEEP

12288:iMrcy907WFdAu6sbI37fpIR+4D+5M/SRQwxEs+S4qAB/aSw4:yyRM+qp6+4MM/SRQ/soBySw4

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

ruka

193.233.20.28:4125

Attributes

auth_value
5d1d0e51ebe1e3f16cca573ff651c43c

Targets

- Target
  
  625a6e5301d0160f38945cff9a8338838461d5f3e2f3fe2bf1b3b35536f6baee
- Size
  
  851KB
- MD5
  
  2253bd37a78f6c6022986a3fbeeedfd2
- SHA1
  
  27ada82b4dbae9e5359f6762bc5d293aeb81ff11
- SHA256
  
  625a6e5301d0160f38945cff9a8338838461d5f3e2f3fe2bf1b3b35536f6baee
- SHA512
  
  884cc1feb1d987da5e065b6bed6c66ca2cc766e36f32f5ce04716608aebf6cc872af0d050cd3c1db1810a30e2bcf8ddd42a1fbbd3e734c903de3cdc3db43dd3c
- SSDEEP
  
  12288:iMrcy907WFdAu6sbI37fpIR+4D+5M/SRQwxEs+S4qAB/aSw4:yyRM+qp6+4MM/SRQ/soBySw4
Score

10^/10

redline gena ruka discovery evasion infostealer persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix

Collection

Data from Local System

T1005

Command and Control

Credential Access

Credentials in Files

T1081

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Discovery

Query Registry

T1012

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Tasks

static1

Score

1^/10

behavioral1

redlinegenarukadiscoveryevasioninfostealerpersistencespywarestealertrojan

Score

10^/10

Sharing

General

Malware Config

Extracted

Extracted

Targets

Modifies Windows Defender Real-time Protection settings

RedLine

RedLine payload

Executes dropped EXE

Reads user/profile data of web browsers

Windows security modification

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

MITRE ATT&CK Matrix

Tasks

static1

behavioral1