Overview

overview

10

Static

static

1

560540e3e5...e8.exe

windows7-x64

10

560540e3e5...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fbe52da6b263c4c5d9eb067c59bef91262f614a722b4742af268864e57cc7520

  • Size

    587KB

  • Sample

    240417-q1va5sab62

  • MD5

    6ebba4af5aeceedc93522665674d1313

  • SHA1

    2c6604898a945a07a5ed133c85531c4e19eef040

  • SHA256

    fbe52da6b263c4c5d9eb067c59bef91262f614a722b4742af268864e57cc7520

  • SHA512

    d07e382bb930f027f4b4f049fb99ad991b2af4c8a2006bb4d22fc6c3d2f3af2738b3f100f4c48f3bfbab8c2c1c969cdc3bd7a957cd7b5ea28b9f2001fbe82a01

  • SSDEEP

    12288:/CqdbBfAndh8oJFldy/GaOZYKxvAOrPS2YbFBf1R6kWSfYwc8UAVzwNUgpKJ0:/CqfAnbv/YGaOZ33LYZfrvfW8JdwNUgj

Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Targets

    • Target

      560540e3e5f5bd294423ad372af1735a67205508a9434045677cc80ea1830fe8.exe

    • Size

      622KB

    • MD5

      e5bb34b508be662784bfd714241d169a

    • SHA1

      a125358133388c02fde8d8addde5222d12bdfbbd

    • SHA256

      560540e3e5f5bd294423ad372af1735a67205508a9434045677cc80ea1830fe8

    • SHA512

      e7e58cb03eb81c54834f38078a72a22d9ddf293df4560f3b06084de523b50b3c4e9f658c4d20469adeb964c0f50b2c5f50911404761e31c99c3e7cc98bcc3e0a

    • SSDEEP

      12288:5HsIkyvDOCug0JN4ojQ1mVRUDbIPX80yKT80S5PV6ii2zl9d7Vi4wvf:5HLkyvyS0/4dItLS5PQDGl9d5ixX

    Score
    10/10
    redlinediscoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks