Overview

overview

10

Static

static

3

160764e2f3...af.exe

windows7-x64

1

160764e2f3...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    160764e2f395ecd512ea174af.exe

  • Size

    288KB

  • Sample

    230625-l868fsdf49

  • MD5

    6ae917525435e23b07d15537fb40aea0

  • SHA1

    7c85b447bb5608ba7fb6a332c033c0cdad0430ae

  • SHA256

    160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a

  • SHA512

    23e5f94e964d53d72af0d6ad31da309539116a9963806ce7b0d3c028a69ab343df6cd6f3989b280e70a285395425a1cb93492fe5030968558ada5f7de047aaed

  • SSDEEP

    6144:Ft+WQdzUUPFTf2HHvKlHQho0jT21v3Ifz/x2ShelxPcWpv:61oqm+QbjTIwr/l00m

Score
10/10
redline1infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

1

C2

dexstat255.xyz:46578

Attributes
  • auth_value

    c4805fc19583231a4c5bb64b0e833716

Targets

    • Target

      160764e2f395ecd512ea174af.exe

    • Size

      288KB

    • MD5

      6ae917525435e23b07d15537fb40aea0

    • SHA1

      7c85b447bb5608ba7fb6a332c033c0cdad0430ae

    • SHA256

      160764e2f395ecd512ea174af36156ad0d2fbe3e3e78a63a90ff90307b22202a

    • SHA512

      23e5f94e964d53d72af0d6ad31da309539116a9963806ce7b0d3c028a69ab343df6cd6f3989b280e70a285395425a1cb93492fe5030968558ada5f7de047aaed

    • SSDEEP

      6144:Ft+WQdzUUPFTf2HHvKlHQho0jT21v3Ifz/x2ShelxPcWpv:61oqm+QbjTIwr/l00m

    Score
    10/10
    redline1infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Blocklisted process makes network request

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks