General
-
Target
file.exe
-
Size
1.1MB
-
Sample
231007-jnnjhacb77
-
MD5
296f35d62c2257cd413d51f024c75a1c
-
SHA1
e82beb9695d098dffce98113c13b740cfdc3ff89
-
SHA256
94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3
-
SHA512
7768057079208dd928355e407f88ae42755a9bd44dffc110bec36ea436f5b7e7d350f1dd481e7ca6459e68114203988091460cf53092a6e4643a16421bc43d42
-
SSDEEP
24576:OyxDRxeJHNtApa0ti0Th+01D6FhmtuIjqCn34j+qBr2EtNFQZ:dnxelNtApxi0Th+Ughmk/Cn3WJIEbF
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
redline
frant
77.91.124.55:19071
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
gigant
77.91.124.55:19071
Targets
-
-
Target
file.exe
-
Size
1.1MB
-
MD5
296f35d62c2257cd413d51f024c75a1c
-
SHA1
e82beb9695d098dffce98113c13b740cfdc3ff89
-
SHA256
94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3
-
SHA512
7768057079208dd928355e407f88ae42755a9bd44dffc110bec36ea436f5b7e7d350f1dd481e7ca6459e68114203988091460cf53092a6e4643a16421bc43d42
-
SSDEEP
24576:OyxDRxeJHNtApa0ti0Th+01D6FhmtuIjqCn34j+qBr2EtNFQZ:dnxelNtApxi0Th+Ughmk/Cn3WJIEbF
-
Detect Mystic stealer payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1