Overview

overview

10

Static

static

7

2 files.zip

windows11-21h2-x64

1

YT.exe

windows11-21h2-x64

10

lolMiner.exe

windows11-21h2-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2 files.zip

  • Size

    10.4MB

  • Sample

    240106-a6vwvsdeen

  • MD5

    6a940041c5e97564d236e6f1438e7c24

  • SHA1

    447159ae64a9797894286a8d56d280836a238c4a

  • SHA256

    edd77cd292cf423b5de8a6e7902c88d2c480a50ff879f562108b3ae433838208

  • SHA512

    87203060eb6e7934398e6958a65d056aa1654388fac03e193310ad966399eef66c030dfc30abb7fbebff23a1933eda89a8ece81ae0692ccbbad8d5136c6f536d

  • SSDEEP

    196608:yPiKBW/uqBA8V2GZP+JlY25nTFBQlGyqwOznWuMuZVORHlI/rJnG/1cX88ycWanJ:yPiKcuqWGcJlN5nxB6duZVuENG8/9LT

Score
10/10
redlinelegaainfostealerspywareupx

Malware Config

Extracted

Family

redline

Botnet

Legaa

C2

185.172.128.33:38294

Targets

    • Target

      2 files.zip

    • Size

      10.4MB

    • MD5

      6a940041c5e97564d236e6f1438e7c24

    • SHA1

      447159ae64a9797894286a8d56d280836a238c4a

    • SHA256

      edd77cd292cf423b5de8a6e7902c88d2c480a50ff879f562108b3ae433838208

    • SHA512

      87203060eb6e7934398e6958a65d056aa1654388fac03e193310ad966399eef66c030dfc30abb7fbebff23a1933eda89a8ece81ae0692ccbbad8d5136c6f536d

    • SSDEEP

      196608:yPiKBW/uqBA8V2GZP+JlY25nTFBQlGyqwOznWuMuZVORHlI/rJnG/1cX88ycWanJ:yPiKcuqWGcJlN5nxB6duZVuENG8/9LT

    Score
    1/10
    behavioral1

    • Target

      YT.exe

    • Size

      2.2MB

    • MD5

      b1087aa5a1a538d7ee3bd9c3b774bb38

    • SHA1

      0842a7d8905be9dbe06f9b2bd7376f33373af246

    • SHA256

      c85533dc3627cc14b81a22fb204c42c9e5527e15ad78c832da7a159825de6ec7

    • SHA512

      46aec87f752382ec9a5ce6f45af70ab54ae3fe158cd2084b27ca55d8224c83417c8a13091648b4b1ffdbf76f2b88ffa0424a76d3619c3516645e70b0c6969cb6

    • SSDEEP

      24576:EQ1OwhF5/u7S/OiUVkcOpckjLDSvWrtaG2cskcA8AvuyLdk0JdQGwct28MENdhX2:DMwP5/u79ScOqkjqOrnq29QFxa

    Score
    10/10
    redlinelegaainfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral2

    • Target

      lolMiner.exe

    • Size

      7.7MB

    • MD5

      055eaec478c4a8490041b8fa3db1119d

    • SHA1

      f0ed5c7d10daaec6f8866e307538e169a2fe6c5e

    • SHA256

      2d4adb8e894b22d6c60c3877995ba5e9845ec6005fc95382c395396eb84b1e73

    • SHA512

      ae9cead17495531c98cca0d174648c24916aa8bda451ad9baad4a5979d6ffa6eb69bfcf11122e02e11fc69f889fa147eeee738a0a6b8a4b837187e5305c524d7

    • SSDEEP

      196608:83OKhONe8nIO7AEXz+992YhlXPBaPS0yc+PfSWUQpdiRNC:83OKIe8eEq99Xhl/BuTQpdd

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks