Overview

overview

10

Static

static

3

f47bd808f9...39.exe

windows7-x64

10

f47bd808f9...39.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f47bd808f90fbe4e53eaed4a71793239.exe

  • Size

    726KB

  • Sample

    230610-zdjqkafg62

  • MD5

    f47bd808f90fbe4e53eaed4a71793239

  • SHA1

    e86d65125e39115835b9a615a30cf820dd3d1914

  • SHA256

    51d1b105b79c3c922cd4bd46524727dcb47cf694bf570d1c53626e15005108b1

  • SHA512

    0cc8ee9ed4b9712738e391928ff4f427adcf61d4c6ba4010e637f3b175101d25d64b054f756a2207c09fb9d8050ba0712360e99cea730873c3b5c3b44feb6248

  • SSDEEP

    12288:KMrvy90NaHstfEo9L5Ksebs6pLFfbIBX2hVYdWDfULXSr8AXD+QR:1y0L5ubbhsBX2h5DfW3W

Score
10/10
redlinedastevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

dast

C2

83.97.73.129:19068

Attributes
  • auth_value

    17d71bf1a3f93284f5848e00b0dd8222

Targets

    • Target

      f47bd808f90fbe4e53eaed4a71793239.exe

    • Size

      726KB

    • MD5

      f47bd808f90fbe4e53eaed4a71793239

    • SHA1

      e86d65125e39115835b9a615a30cf820dd3d1914

    • SHA256

      51d1b105b79c3c922cd4bd46524727dcb47cf694bf570d1c53626e15005108b1

    • SHA512

      0cc8ee9ed4b9712738e391928ff4f427adcf61d4c6ba4010e637f3b175101d25d64b054f756a2207c09fb9d8050ba0712360e99cea730873c3b5c3b44feb6248

    • SSDEEP

      12288:KMrvy90NaHstfEo9L5Ksebs6pLFfbIBX2hVYdWDfULXSr8AXD+QR:1y0L5ubbhsBX2h5DfW3W

    Score
    10/10
    redlinedastevasioninfostealerpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks