Overview

overview

10

Static

static

3

easy spoofer.exe

windows7-x64

10

easy spoofer.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    easy spoofer.exe

  • Size

    305KB

  • Sample

    240201-yhhtdsfebn

  • MD5

    c03f9fb59cd25d59cb01580c35c62628

  • SHA1

    0af6d27cf52b7a700344355d645819a9713c8f9f

  • SHA256

    b2c593216ac245518637d7932754c4c1128f6c331a601853b4e3c6d01a9dc088

  • SHA512

    8704d778103b948bd3b826111259b59e1b17d1589818923d6dd01b3c1918c4a6357cd9a62e03776d7c1927dfac199b6ed491006cddb772b22e4019af14572c9c

  • SSDEEP

    6144:/jOkC7ObDqTMm2f48xJTukf8CcMbjI3hz/uyZkWv:/wa9m2f48xJTukvcMvhyZkW

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      easy spoofer.exe

    • Size

      305KB

    • MD5

      c03f9fb59cd25d59cb01580c35c62628

    • SHA1

      0af6d27cf52b7a700344355d645819a9713c8f9f

    • SHA256

      b2c593216ac245518637d7932754c4c1128f6c331a601853b4e3c6d01a9dc088

    • SHA512

      8704d778103b948bd3b826111259b59e1b17d1589818923d6dd01b3c1918c4a6357cd9a62e03776d7c1927dfac199b6ed491006cddb772b22e4019af14572c9c

    • SSDEEP

      6144:/jOkC7ObDqTMm2f48xJTukf8CcMbjI3hz/uyZkWv:/wa9m2f48xJTukvcMvhyZkW

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks