Overview

overview

10

Static

static

3

d47e5b2f2e...58.exe

windows7-x64

10

d47e5b2f2e...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d47e5b2f2e7ceaaa0ed233fa834340859543b4b52f79f56d1524e5ff59ff7458.exe

  • Size

    325KB

  • Sample

    240423-cddg8abd9t

  • MD5

    c1ccdae0143c09701899efb5bbdd9e10

  • SHA1

    c2d598b52379983d8e9e92d5da3f0412c474eff2

  • SHA256

    d47e5b2f2e7ceaaa0ed233fa834340859543b4b52f79f56d1524e5ff59ff7458

  • SHA512

    df28c24b060467de8ff4a2e464062ef3d12d2dfbb493d28b3a5b6d494e19797081da61140695e4f346bd9edc03a20e6252553695b6dcfe329c33744daba7c497

  • SSDEEP

    6144:q7XPXBi74sHg9Nvhq6AXK4AjOqWvzTkGmXS:qFOHg9QOWvzzmXS

Score
10/10
redline7001210066infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

7001210066

C2

https://pastebin.com/raw/KE5Mft0T

Targets

    • Target

      d47e5b2f2e7ceaaa0ed233fa834340859543b4b52f79f56d1524e5ff59ff7458.exe

    • Size

      325KB

    • MD5

      c1ccdae0143c09701899efb5bbdd9e10

    • SHA1

      c2d598b52379983d8e9e92d5da3f0412c474eff2

    • SHA256

      d47e5b2f2e7ceaaa0ed233fa834340859543b4b52f79f56d1524e5ff59ff7458

    • SHA512

      df28c24b060467de8ff4a2e464062ef3d12d2dfbb493d28b3a5b6d494e19797081da61140695e4f346bd9edc03a20e6252553695b6dcfe329c33744daba7c497

    • SSDEEP

      6144:q7XPXBi74sHg9Nvhq6AXK4AjOqWvzTkGmXS:qFOHg9QOWvzzmXS

    Score
    10/10
    redline7001210066infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks