Overview

overview

10

Static

static

1

106445763c...34.exe

windows7-x64

10

106445763c...34.exe

windows10-2004-x64

10

Resubmissions

08-04-2024 13:45

240408-q2dpsaae25 10

21-11-2023 22:21

231121-196ewagh72 10

21-11-2023 22:20

231121-183ycshf5y 10

21-11-2023 22:06

231121-1z2c6sgh38 10

27-08-2023 18:38

230827-w98ssaee5z 10

01-06-2023 22:35

230601-2h4yeagg74 10

21-04-2023 17:56

230421-whz2kahb76 10

16-04-2023 14:28

230416-rtht7sad45 10

16-04-2023 14:28

230416-rs4qaaca91 1

16-04-2023 14:22

230416-rpvyzaad38 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34

  • Size

    1.2MB

  • Sample

    230416-rtht7sad45

  • MD5

    5b3b6822964b4151c6200ecd89722a86

  • SHA1

    ce7a11dae532b2ade1c96619bbdc8a8325582049

  • SHA256

    106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34

  • SHA512

    2f0d99af35c326cf46810c7421325deb55ae7ca36a8edc2716a3d32d9e6769e0d374581a98912e22fceeb6973e972463ed8b2fa4d4399043c443fa100dfd17b0

  • SSDEEP

    24576:5yY4YriuQJ5X4SuIcmuBLahxwUzN1YyqoVKucvTNLF9:sY4FuIahGxRMoobNLF

Score
10/10
redlineronurevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes
  • auth_value

    f88f86755a528d4b25f6f3628c460965

Targets

    • Target

      106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34

    • Size

      1.2MB

    • MD5

      5b3b6822964b4151c6200ecd89722a86

    • SHA1

      ce7a11dae532b2ade1c96619bbdc8a8325582049

    • SHA256

      106445763c386e992ded6aa68f37f2dd77272d6ea3c6fff34eb70c5ef094aa34

    • SHA512

      2f0d99af35c326cf46810c7421325deb55ae7ca36a8edc2716a3d32d9e6769e0d374581a98912e22fceeb6973e972463ed8b2fa4d4399043c443fa100dfd17b0

    • SSDEEP

      24576:5yY4YriuQJ5X4SuIcmuBLahxwUzN1YyqoVKucvTNLF9:sY4FuIahGxRMoobNLF

    Score
    10/10
    redlineronurevasioninfostealerpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks