Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    575KB

  • Sample

    230617-lv6prsah4z

  • MD5

    7e1c47ca9cef11631ddd096c1d3639c7

  • SHA1

    4e8d9b1efb8b4b7b316e5a7fd3fb808e2da759a8

  • SHA256

    02c640ef3ac9d7fa8c919b0f72bb85413ef3e9803d2d091277b9a7c41f52e9d9

  • SHA512

    fa029905bf1921ab433f949167e64874e5da3e98908da38c92ae8e4db987a6ab786f68942993e34c92f713d7bf701e4d066da9abde7b88b6ff018663ba79490a

  • SSDEEP

    6144:qTov37S4OHn8MDIYKReFMjkyI/VYXVhUYbjDyVlQBCVTI:qcv37SajRVjziVq3gVlsCVT

Score
10/10
redline2infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

2

C2

95.216.249.153:81

Attributes
  • auth_value

    101013a5e99e0857595aae297a11351d

Targets

    • Target

      file.exe

    • Size

      575KB

    • MD5

      7e1c47ca9cef11631ddd096c1d3639c7

    • SHA1

      4e8d9b1efb8b4b7b316e5a7fd3fb808e2da759a8

    • SHA256

      02c640ef3ac9d7fa8c919b0f72bb85413ef3e9803d2d091277b9a7c41f52e9d9

    • SHA512

      fa029905bf1921ab433f949167e64874e5da3e98908da38c92ae8e4db987a6ab786f68942993e34c92f713d7bf701e4d066da9abde7b88b6ff018663ba79490a

    • SSDEEP

      6144:qTov37S4OHn8MDIYKReFMjkyI/VYXVhUYbjDyVlQBCVTI:qcv37SajRVjziVq3gVlsCVT

    Score
    10/10
    redline2infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks