Overview

overview

10

Static

static

1

124adb0a0e...de.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    124adb0a0efcf7f8306fd05d4c13ee429f79a0065778fa19207d9f6ddd3fb0de.exe

  • Size

    345KB

  • Sample

    240203-gr7ensagd6

  • MD5

    268cf16a004a6b7515bec416b64ee904

  • SHA1

    9f65969bb579206dc46baadce4a294004b7a1a32

  • SHA256

    124adb0a0efcf7f8306fd05d4c13ee429f79a0065778fa19207d9f6ddd3fb0de

  • SHA512

    934c2a850076a8e5084cee21a6b5a73aaac368c48d2e90bcd1ec4794214f93caa1be368464ddecf6673434732e5acfb24043802b6e5736c29907589f6d32f79c

  • SSDEEP

    6144:NDKW1Fgbdl0TBBvjc/xqFbCfgJFPA7rtPNdxGrP0n8DdFd8EiylyckrTrT:lh1Fk70TnvjcpgVBAnpcDfGz

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      124adb0a0efcf7f8306fd05d4c13ee429f79a0065778fa19207d9f6ddd3fb0de.exe

    • Size

      345KB

    • MD5

      268cf16a004a6b7515bec416b64ee904

    • SHA1

      9f65969bb579206dc46baadce4a294004b7a1a32

    • SHA256

      124adb0a0efcf7f8306fd05d4c13ee429f79a0065778fa19207d9f6ddd3fb0de

    • SHA512

      934c2a850076a8e5084cee21a6b5a73aaac368c48d2e90bcd1ec4794214f93caa1be368464ddecf6673434732e5acfb24043802b6e5736c29907589f6d32f79c

    • SSDEEP

      6144:NDKW1Fgbdl0TBBvjc/xqFbCfgJFPA7rtPNdxGrP0n8DdFd8EiylyckrTrT:lh1Fk70TnvjcpgVBAnpcDfGz

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks