Overview

overview

10

Static

static

10

715dfcd7ca...d9.exe

windows7-x64

10

715dfcd7ca...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6754d3c831c2392dd5a35b5768df4c37.bin

  • Size

    118KB

  • Sample

    240205-bv85sahdfm

  • MD5

    7ea6ae07b9d5a4af53a7888a4740a6ff

  • SHA1

    cafeb87930bd8e14b637d1b26c75bfffb446dca7

  • SHA256

    4acfbea2a0c4f806c303ab7875cbdb0a8fe60d3df9a67d063f7170e01615ed0b

  • SHA512

    38b575c7aafbc5fc24b7e71069c585b3d1e6114fef9f7259d83bbee2f3de8f39ffda4e090297116cbc91c4f0a9310a8ed48ecf81a2ef57169a817dda65249090

  • SSDEEP

    3072:bdEeAhsJcDmFrIqaG2Y7KEthvbWrPToaMRA:bdEeaJzhu7KEthMZ

Score
10/10
redline1discoveryinfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

1

C2

92.222.212.74:1450

Targets

    • Target

      715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9.exe

    • Size

      313KB

    • MD5

      6754d3c831c2392dd5a35b5768df4c37

    • SHA1

      3a1bac47966c643c1587b734f19e7963c56e8dee

    • SHA256

      715dfcd7ca54a83c37acf2e093a0c3703732b2e3fceb52fcf5037f37e333bad9

    • SHA512

      2d373f936746f2bf962dbac09779d1b7c7f93dec7d8728f2c3db8bda36da290539e49b8d3bdcbeef28ab1d6e126f8632c009f5583ebb1b2d3cba4ba18e6245dd

    • SSDEEP

      3072:QA0UpT1W+9dAoDc0ib8fy+8EnelxlmyxkMRqfjDv/YUeqiOL2bBOJ:4sHdGjb8KNxADMRqfjD4aL

    Score
    10/10
    redline1discoveryinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks