Overview

overview

10

Static

static

1

BloxPredictor.bat

windows7-x64

10

BloxPredictor.bat

windows10-1703-x64

8

BloxPredictor.bat

windows10-2004-x64

8

Resubmissions

17-04-2023 11:32

230417-nnl3wsdh66 10

29-08-2022 04:21

220829-eyzx3acfg9 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BloxPredictor.bat

  • Size

    24KB

  • Sample

    230417-nnl3wsdh66

  • MD5

    a4a8c94e504ac6ca0ab89e9602757b7d

  • SHA1

    b6e014f2ee929e6522c2f88cef198e8488d1b076

  • SHA256

    95ac6e414cd46ab5ec8d652944120157bedb5a6373efc5ee34656b0d0e6ed9ef

  • SHA512

    29dd2a53d7cad6440c58b30702517796565f8b91d837cf7ad12b29a4f831c32a7011eefb19868048c04f500ca726e6313574b178baea54cb4944a2878e917fa8

  • SSDEEP

    384:XjkB9T5RQ04oNa0VVP/7hdD4HO6oboIsR6a5toa9nb8QbUNFu8BHirCtc:g9TDQ0rD8obYD5tnAbTliEc

Score
10/10
redlineinfostealerstealer

Malware Config

Targets

    • Target

      BloxPredictor.bat

    • Size

      24KB

    • MD5

      a4a8c94e504ac6ca0ab89e9602757b7d

    • SHA1

      b6e014f2ee929e6522c2f88cef198e8488d1b076

    • SHA256

      95ac6e414cd46ab5ec8d652944120157bedb5a6373efc5ee34656b0d0e6ed9ef

    • SHA512

      29dd2a53d7cad6440c58b30702517796565f8b91d837cf7ad12b29a4f831c32a7011eefb19868048c04f500ca726e6313574b178baea54cb4944a2878e917fa8

    • SSDEEP

      384:XjkB9T5RQ04oNa0VVP/7hdD4HO6oboIsR6a5toa9nb8QbUNFu8BHirCtc:g9TDQ0rD8obYD5tnAbTliEc

    Score
    10/10
    redlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v6

Tasks