Overview

overview

10

Static

static

10

4d9a322ae9...2a.exe

windows7-x64

10

4d9a322ae9...2a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d9a322ae9761ae4e43245fdf2da2d28d22cc9c8512dc2212f293d1d5000922a.zip

  • Size

    51KB

  • Sample

    230328-ls6xraca3x

  • MD5

    42415dead762e4f1fc477795539d25a9

  • SHA1

    2022523988df9dfd16ad42cccf6a5f19341c7f27

  • SHA256

    a79cb9b5286a74bab12701be23253e45840ead1557a704e0d7f028ad542f6f29

  • SHA512

    edfa5cced6bcb5a14fa1ccb62dcc140799dee4a4894ec83e9e32a4cd131abe8d6dcb9c5bf91d0fa530958aa1a6c198c8b2b2b84abb07ea88b388f22e0b10f62a

  • SSDEEP

    1536:bfZlP+MHWztHF9HVO0tvYDG9aiIJSghnuBS:/+MHQFHvtKLvhuBS

Score
10/10
redlinefromdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Targets

    • Target

      4d9a322ae9761ae4e43245fdf2da2d28d22cc9c8512dc2212f293d1d5000922a

    • Size

      175KB

    • MD5

      7bd3bdf92297e531c88f3a80082d5480

    • SHA1

      991c1945ff6e815f606275c12251ef8918bb6d55

    • SHA256

      4d9a322ae9761ae4e43245fdf2da2d28d22cc9c8512dc2212f293d1d5000922a

    • SHA512

      9cc34a328ec019c130140ea4783c77945f91d95786c86cfbc5cd6af0af2b30fccf9c9d215b7f2d5a6bc116b495090953885a6c2a7c738aa4e95fa6a0e7e7e67d

    • SSDEEP

      3072:4xqZWZRanU2n0/Z62eJ5evJ9ih+PxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOm:mqZg/Z6XJIih

    Score
    10/10
    redlinefromdiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks