Overview

overview

10

Static

static

1

winprofile

windows7-x64

1

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79fa614df18d0167283e04f19238f4652d5bdb333efcf7a9a264694c77382c90

  • Size

    303KB

  • Sample

    230528-ff9j8aeb99

  • MD5

    c9f3c70dd74321d4929b30542e34585e

  • SHA1

    a9206a76fa0ed0bde496812ea0d1a0a8607d1257

  • SHA256

    79fa614df18d0167283e04f19238f4652d5bdb333efcf7a9a264694c77382c90

  • SHA512

    8257615bd50341e201316ba3795ff695681513f6e592af5e5688331b8a1b485c0cc02a2118d19a2c5ab3e2ec67c1bdfe75639df0778fa639ee7b58203adf444b

  • SSDEEP

    6144:oU8SJqC9ieTRoDLh5fIlRDOP42aIZKIy8R4drsWRWOcrgQcLKG1IOq:OGqC9DaDElRuen8irhWO5Q0X14

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      79fa614df18d0167283e04f19238f4652d5bdb333efcf7a9a264694c77382c90

    • Size

      303KB

    • MD5

      c9f3c70dd74321d4929b30542e34585e

    • SHA1

      a9206a76fa0ed0bde496812ea0d1a0a8607d1257

    • SHA256

      79fa614df18d0167283e04f19238f4652d5bdb333efcf7a9a264694c77382c90

    • SHA512

      8257615bd50341e201316ba3795ff695681513f6e592af5e5688331b8a1b485c0cc02a2118d19a2c5ab3e2ec67c1bdfe75639df0778fa639ee7b58203adf444b

    • SSDEEP

      6144:oU8SJqC9ieTRoDLh5fIlRDOP42aIZKIy8R4drsWRWOcrgQcLKG1IOq:OGqC9DaDElRuen8irhWO5Q0X14

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks