General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbnBHUXUwQkpsSVB5dTBaRDMwcTJWbzVYWXZ6QXxBQ3Jtc0ttRzJwbGltcmZsenNMUk93Vm14X29OS2ZHcFRCLV9ZVTBrbHhZVlF1RnEwb3QzX1RNcEpEOXBQdEdBOWc3M1pjZDZnYWpDd0pmUk1BWTlZbjREQ2UxYm9UeDU0RjhOd2s1MEYtWWRfSUttUWxrRktGWQ&q=https%3A%2F%2Fpcworlds.us%2Ffortnite-mod-menu-for-pc%2F&v=8EsBxkYNyME
-
Sample
230612-n6h4yscf3s
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbnBHUXUwQkpsSVB5dTBaRDMwcTJWbzVYWXZ6QXxBQ3Jtc0ttRzJwbGltcmZsenNMUk93Vm14X29OS2ZHcFRCLV9ZVTBrbHhZVlF1RnEwb3QzX1RNcEpEOXBQdEdBOWc3M1pjZDZnYWpDd0pmUk1BWTlZbjREQ2UxYm9UeDU0RjhOd2s1MEYtWWRfSUttUWxrRktGWQ&q=https%3A%2F%2Fpcworlds.us%2Ffortnite-mod-menu-for-pc%2F&v=8EsBxkYNyME
Resource
win10-20230220-en
Malware Config
Extracted
redline
@hendrolas
94.142.138.4:80
-
auth_value
71d16d25eddbb4fd3b98070432f1a757
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbnBHUXUwQkpsSVB5dTBaRDMwcTJWbzVYWXZ6QXxBQ3Jtc0ttRzJwbGltcmZsenNMUk93Vm14X29OS2ZHcFRCLV9ZVTBrbHhZVlF1RnEwb3QzX1RNcEpEOXBQdEdBOWc3M1pjZDZnYWpDd0pmUk1BWTlZbjREQ2UxYm9UeDU0RjhOd2s1MEYtWWRfSUttUWxrRktGWQ&q=https%3A%2F%2Fpcworlds.us%2Ffortnite-mod-menu-for-pc%2F&v=8EsBxkYNyME
Score10/10-
Detects Lobshot family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-