Overview

overview

10

Static

static

3

b2952a2821...30.exe

windows7-x64

10

b2952a2821...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2952a282144c042f368121f3d991630.exe

  • Size

    399KB

  • Sample

    231113-rk413sdd94

  • MD5

    b2952a282144c042f368121f3d991630

  • SHA1

    1c5d07dcc869d0667a6225202b4f87380cc9de67

  • SHA256

    bc3ce9adeb97d068e11f11fe6219ff29fd6e17ed2e5c175a19bbd5071fc32358

  • SHA512

    db781e7a874e9d3c2d565dc4760e8ad0b013b1e78332e430590d638afa34aed1d160e22db8200807ddaacd8d38c356f2f922318ca319527a1f33c85e1329bc8c

  • SSDEEP

    12288:cp/lcW+rMQCUIJF8Fb0RP3Wq8argJcKKkQP5:cr+Jdt0RP3Wq8argJcKKkQh

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      b2952a282144c042f368121f3d991630.exe

    • Size

      399KB

    • MD5

      b2952a282144c042f368121f3d991630

    • SHA1

      1c5d07dcc869d0667a6225202b4f87380cc9de67

    • SHA256

      bc3ce9adeb97d068e11f11fe6219ff29fd6e17ed2e5c175a19bbd5071fc32358

    • SHA512

      db781e7a874e9d3c2d565dc4760e8ad0b013b1e78332e430590d638afa34aed1d160e22db8200807ddaacd8d38c356f2f922318ca319527a1f33c85e1329bc8c

    • SSDEEP

      12288:cp/lcW+rMQCUIJF8Fb0RP3Wq8argJcKKkQP5:cr+Jdt0RP3Wq8argJcKKkQh

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks