Overview

overview

10

Static

static

1

b82fcf368b...21.exe

windows7-x64

10

b82fcf368b...21.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4842aafe330a4066543e094290f55d21.bin

  • Size

    639KB

  • Sample

    230328-bvfhgagc52

  • MD5

    af893cef48a10c3d8370adb14b55ae99

  • SHA1

    cf72a522c1a547dc7f30d4b49e785b2457df4703

  • SHA256

    088b0658153a7ad4ff47b113577aa4cc874d2381f0402a317074706761a498a1

  • SHA512

    8a4c8a56dc2a3c19e95372a10be842b1521f219759addf64004471d4e66994949ce5e874b54b37d43fddd6741021ec6415a0241d6603abc2c7a8fc9afd6e25da

  • SSDEEP

    12288:aCYLV6BO/PawXbtrTI9u/fAzp7qtt/o3NhO4tMv307ON:aCYLFa4t3IHzlmh4NA4SvEi

Score
10/10
redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

dent

C2

193.233.20.33:4125

Attributes
  • auth_value

    e795368557f02e28e8aef6bcb279a3b0

Targets

    • Target

      b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe

    • Size

      682KB

    • MD5

      4842aafe330a4066543e094290f55d21

    • SHA1

      710fdaa38e74a58a7c73de8fa70bcc0d02b9e82d

    • SHA256

      b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21

    • SHA512

      d95b988b48f25169e83b515ac14fe40adad5cb55b715634af4c4357d87ca6f2500c72d16e05508ce47f5e978035b6b5226bc17e698cee36d79ccb4abf5118525

    • SSDEEP

      12288:JMrmy90JiFq4Cfr2vNVhlpaktBMuhWNhtt24JqKY42mZ:jyF4fcjnpasS/j24JqKYg

    Score
    10/10
    redlinedentsonydiscoveryevasioninfostealerpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks