Overview

overview

10

Static

static

1

neon_v3.zip

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    neon_v3.zip

  • Size

    156KB

  • Sample

    240316-ck5kaahd5y

  • MD5

    489dbf17efaea515b28d9739e0679a6a

  • SHA1

    b6cf2813db67c791aaad4c310a1626c9eabdb4c1

  • SHA256

    f0571c2d98a230d8a0492545ccf7a0dc2f20d5725afac5896249d067bc32e651

  • SHA512

    e116613a9b399a16c09f01213232fe21a7c5f1b68aa45421411cd0209a298c87d5a634c3aadb7b44fcffe4637c6d917902dd9e923a30bd365e5ad36d669c0d69

  • SSDEEP

    3072:OOfF1YaccgnfONTkJLlbNSBV+vYUbtCR86f6brektxPElEOBX:7fngfyTkLl5SBVsbtCR86f6brzzTOBX

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      neon_v3.zip

    • Size

      156KB

    • MD5

      489dbf17efaea515b28d9739e0679a6a

    • SHA1

      b6cf2813db67c791aaad4c310a1626c9eabdb4c1

    • SHA256

      f0571c2d98a230d8a0492545ccf7a0dc2f20d5725afac5896249d067bc32e651

    • SHA512

      e116613a9b399a16c09f01213232fe21a7c5f1b68aa45421411cd0209a298c87d5a634c3aadb7b44fcffe4637c6d917902dd9e923a30bd365e5ad36d669c0d69

    • SSDEEP

      3072:OOfF1YaccgnfONTkJLlbNSBV+vYUbtCR86f6brektxPElEOBX:7fngfyTkLl5SBVsbtCR86f6brzzTOBX

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks