Overview

overview

10

Static

static

1

qu3031.exe

windows7-x64

10

qu3031.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    qu3031.exe

  • Size

    345KB

  • Sample

    230328-d7w24aaf5w

  • MD5

    123d4ad0b6ff03500edba05b11c1671b

  • SHA1

    91e37cea652c56fa4a1392d23e81631f8a8a9e5f

  • SHA256

    295a967765f271e81098a48ad70905c64973266742d655e18c27369d00f13280

  • SHA512

    db03c1c4e8389706821820af0514faefda358f9ae3a9efd5a34bac78fd50dae8bc95498b3fd545e839cdd916373a7ebe1da8ddd8efa69b8029f891b780d0d9af

  • SSDEEP

    6144:hiuo+rLcXfNbdX5AoKpelCoQqDmJLIGv7XpCd3bM/zDig02TpgBsDiYn:hiuTrYXfNb5yoKH2mJ/v70rOfigLKe

Score
10/10
redlinerosndiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Targets

    • Target

      qu3031.exe

    • Size

      345KB

    • MD5

      123d4ad0b6ff03500edba05b11c1671b

    • SHA1

      91e37cea652c56fa4a1392d23e81631f8a8a9e5f

    • SHA256

      295a967765f271e81098a48ad70905c64973266742d655e18c27369d00f13280

    • SHA512

      db03c1c4e8389706821820af0514faefda358f9ae3a9efd5a34bac78fd50dae8bc95498b3fd545e839cdd916373a7ebe1da8ddd8efa69b8029f891b780d0d9af

    • SSDEEP

      6144:hiuo+rLcXfNbdX5AoKpelCoQqDmJLIGv7XpCd3bM/zDig02TpgBsDiYn:hiuTrYXfNb5yoKH2mJ/v70rOfigLKe

    Score
    10/10
    redlinerosndiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks