Overview

overview

10

Static

static

3

a13a1f2fe5...64.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a13a1f2fe5ee62cfd08004277f557664.exe

  • Size

    611KB

  • Sample

    231122-pp2emscd38

  • MD5

    a13a1f2fe5ee62cfd08004277f557664

  • SHA1

    af8581903c06152c9650deba3abe92260fa891e2

  • SHA256

    8982eecbc6365b0320c57d0d186f0b0569a6cb619da669f5a87ad3ad7b09e698

  • SHA512

    acf62fed3e86b850152349a6cae3b0d68d493f6ad09e5594f1528c15e93392635caad1d237ba1ab4fc4a539340d21e16d49102489bc58c05e9a5b9d123e94357

  • SSDEEP

    12288:yivy90H6buQKNrjeqrvbg7tvXyfl7W1FgQNPuZtPF:yky5buQcmuWvXgW16ePu/d

Score
10/10
redlineinfostealerpersistencespyware

Malware Config

Targets

    • Target

      a13a1f2fe5ee62cfd08004277f557664.exe

    • Size

      611KB

    • MD5

      a13a1f2fe5ee62cfd08004277f557664

    • SHA1

      af8581903c06152c9650deba3abe92260fa891e2

    • SHA256

      8982eecbc6365b0320c57d0d186f0b0569a6cb619da669f5a87ad3ad7b09e698

    • SHA512

      acf62fed3e86b850152349a6cae3b0d68d493f6ad09e5594f1528c15e93392635caad1d237ba1ab4fc4a539340d21e16d49102489bc58c05e9a5b9d123e94357

    • SSDEEP

      12288:yivy90H6buQKNrjeqrvbg7tvXyfl7W1FgQNPuZtPF:yky5buQcmuWvXgW16ePu/d

    Score
    10/10
    redlineinfostealerpersistencespyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks