Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de5b12b7d320bb45eabbb5bbcb80668d01b3c3f4bff3b25f418c90e4506b4637

  • Size

    3.8MB

  • Sample

    240107-2ekqcsgef3

  • MD5

    6c495d32cd41ec78c256d1f3dbf53312

  • SHA1

    088e77057a7967826bdada4fa494381312a7186a

  • SHA256

    de5b12b7d320bb45eabbb5bbcb80668d01b3c3f4bff3b25f418c90e4506b4637

  • SHA512

    98c4f2164bcc448a69b40a69f88e24d5fa7db1a6a0f6c3f17c71859290ad5b6aaa09682f069a260ddaf8f362e399381c43e67eacf4bc4485e2a3d7bcb773e791

  • SSDEEP

    49152:MuS/X7Nrl7FdOVchjIO4CdfNGElegA8vt/jW2AKGYvKfSvKwb:m/X1l7QElQgNvZjW2AKGYvm3q

Score
10/10
redline777infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

777

C2

195.20.16.103:20440

Targets

    • Target

      de5b12b7d320bb45eabbb5bbcb80668d01b3c3f4bff3b25f418c90e4506b4637

    • Size

      3.8MB

    • MD5

      6c495d32cd41ec78c256d1f3dbf53312

    • SHA1

      088e77057a7967826bdada4fa494381312a7186a

    • SHA256

      de5b12b7d320bb45eabbb5bbcb80668d01b3c3f4bff3b25f418c90e4506b4637

    • SHA512

      98c4f2164bcc448a69b40a69f88e24d5fa7db1a6a0f6c3f17c71859290ad5b6aaa09682f069a260ddaf8f362e399381c43e67eacf4bc4485e2a3d7bcb773e791

    • SSDEEP

      49152:MuS/X7Nrl7FdOVchjIO4CdfNGElegA8vt/jW2AKGYvKfSvKwb:m/X1l7QElQgNvZjW2AKGYvm3q

    Score
    10/10
    redline777infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks