Overview

overview

10

Static

static

1

3c1769ad78...9e.exe

windows7-x64

10

3c1769ad78...9e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    448da7691ae07d60272790296c33328c.bin

  • Size

    236KB

  • Sample

    230319-wcq7gabe8y

  • MD5

    0af59a96f10c4de9e2e01f9b3b167f90

  • SHA1

    0f4061a66eece2459076dea04c52a18dcb8fecdf

  • SHA256

    7acca3f263852981fad46944b2591086b9e25f1e85a7fd8583758dc72dadfbe9

  • SHA512

    5a119c0da14fba4fe429baa2c01dca0336b426345924f3bb91ea72807f3b773348796a6b412f5eeb699c88323cd5f8e64867f88e2629ef7ba549e64d6e6f0c99

  • SSDEEP

    3072:1ArYxKjJiglHDNym/svTXWsjWFfZv6a4ish6JRR7xbRV2o1dU4+HCUfJogiiw6fx:15xCig6WsjSUidvXdU4wDQiwhk7rLJZ

Score
10/10
redlinemangodiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Targets

    • Target

      3c1769ad786efc178640a7f744e02f048707c72b27d781531f64dd16e1822e9e.exe

    • Size

      301KB

    • MD5

      448da7691ae07d60272790296c33328c

    • SHA1

      5678220047e78f21b5a48dd92179203455d67e7d

    • SHA256

      3c1769ad786efc178640a7f744e02f048707c72b27d781531f64dd16e1822e9e

    • SHA512

      7b6addce20b4c884936810314c3d2b6786749a9eb04351e2767b7aa7d23e5dce52b1f955e7d7d9af354a2e230ac0e9c21f0adf1dfbd10e6b70d25f27676aa146

    • SSDEEP

      6144:uqj+2zJgcNDah8dL6Ivyg1rskXlFNHa5CK:LFzJgGA8zxBnN65

    Score
    10/10
    redlinemangodiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks