Overview

overview

10

Static

static

1

Pass_2023_...r.html

windows10-1703-x64

10

Resubmissions

01-04-2023 02:21

230401-cszn1agg2s 10

01-04-2023 02:20

230401-csnlqsfd55 1

01-04-2023 02:17

230401-cqqnbafd36 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Pass_2023_Setup.rar.html

  • Size

    19KB

  • Sample

    230401-cszn1agg2s

  • MD5

    e714b3ab1380b7acf4f572d570125444

  • SHA1

    9359a9069f5cdfe9a7ff8c372aab9f543516f17d

  • SHA256

    948138b91d471c0c5e690b2a25e677723caaa2698e0f156b945f056545faa4bc

  • SHA512

    35cd9e548b1be61fec56c2626f0bc13352faba93cd528e7492ccb5682737b9f514430e6379e40b951ae0213806ee77536175009c27653fad6a2b94533951a88f

  • SSDEEP

    384:boJylIn7xpYwuu504YfeHYK3DRzhU3E8+UUKIz40qo+Q0aN0ba9l3eBizEmZX3:boJCIn7XY20tODRzh4E8+UUKIz40qoWu

Score
10/10
redlineyoutube02evasioninfostealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

youtube02

C2

176.113.115.220:80

Attributes
  • auth_value

    ac97023fed55cb3e4792a779ef00ca98

Targets

    • Target

      Pass_2023_Setup.rar.html

    • Size

      19KB

    • MD5

      e714b3ab1380b7acf4f572d570125444

    • SHA1

      9359a9069f5cdfe9a7ff8c372aab9f543516f17d

    • SHA256

      948138b91d471c0c5e690b2a25e677723caaa2698e0f156b945f056545faa4bc

    • SHA512

      35cd9e548b1be61fec56c2626f0bc13352faba93cd528e7492ccb5682737b9f514430e6379e40b951ae0213806ee77536175009c27653fad6a2b94533951a88f

    • SSDEEP

      384:boJylIn7xpYwuu504YfeHYK3DRzhU3E8+UUKIz40qo+Q0aN0ba9l3eBizEmZX3:boJCIn7XY20tODRzh4E8+UUKIz40qoWu

    Score
    10/10
    redlineyoutube02evasioninfostealerthemidatrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Uses the VBS compiler for execution

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Scripting

1
T1064

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks