Overview

overview

10

Static

static

10

05339499.exe

windows7-x64

10

05339499.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05339499.dat

  • Size

    172KB

  • Sample

    230614-pm7tmsgh24

  • MD5

    220004a837e2899cd45a98dfe7ceb928

  • SHA1

    971da444cb7a84b7b815c5d89b358c465d5ff29d

  • SHA256

    15f9cf91946ece17caf396bc136648a04206ddea881eaef4b363803542dd4b78

  • SHA512

    27cfdfa265a52035a6b4ccd4253d1b3d7b2cb88a1320ae45b63893f6bf0296483a179bf5460d39fe59020036bb8ab21f21d00f73ad34941d30a13c9a658b270c

  • SSDEEP

    1536:skPZ36sv0W7TVOn0urHrj7mZvDZZTwIt1xN9UYQrfbutXN3o0oQo0GkRY8e8hL:skXYz3slZvt1xNZOqG0oQob8e8hL

Score
10/10
redlinemaxidiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.130:19061

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Targets

    • Target

      05339499.dat

    • Size

      172KB

    • MD5

      220004a837e2899cd45a98dfe7ceb928

    • SHA1

      971da444cb7a84b7b815c5d89b358c465d5ff29d

    • SHA256

      15f9cf91946ece17caf396bc136648a04206ddea881eaef4b363803542dd4b78

    • SHA512

      27cfdfa265a52035a6b4ccd4253d1b3d7b2cb88a1320ae45b63893f6bf0296483a179bf5460d39fe59020036bb8ab21f21d00f73ad34941d30a13c9a658b270c

    • SSDEEP

      1536:skPZ36sv0W7TVOn0urHrj7mZvDZZTwIt1xN9UYQrfbutXN3o0oQo0GkRY8e8hL:skXYz3slZvt1xNZOqG0oQob8e8hL

    Score
    10/10
    redlinemaxidiscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks