Overview

overview

10

Static

static

3

44088360d2...KI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44088360d2a85b605505472cff282320_NEIKI

  • Size

    1.5MB

  • Sample

    240508-zc4z4sec51

  • MD5

    44088360d2a85b605505472cff282320

  • SHA1

    55996324c41a0507205395fe2bd3939c1f69499b

  • SHA256

    09d9ead98677cbc6f36f6ee0761fd9957c2c849bd35989990f220cec24f39918

  • SHA512

    a69a41fa0267358162d927e89574679e47a41c440fc6c298c197fba1c314ec80bc647be6d9964dc23357054423aad22fda869e0e658f82b6f35ea6d93d074045

  • SSDEEP

    24576:eyUQBKaUoqjr16ZSUuxLWNEWE0k8g04mAGm/YpA+AK/zU:tqaUoqn1601xLWNxxkV9mAW

Score
10/10
mysticredlinekukishinfostealerpersistencestealer

Malware Config

Extracted

Family

redline

Botnet

kukish

C2

77.91.124.55:19071

Targets

    • Target

      44088360d2a85b605505472cff282320_NEIKI

    • Size

      1.5MB

    • MD5

      44088360d2a85b605505472cff282320

    • SHA1

      55996324c41a0507205395fe2bd3939c1f69499b

    • SHA256

      09d9ead98677cbc6f36f6ee0761fd9957c2c849bd35989990f220cec24f39918

    • SHA512

      a69a41fa0267358162d927e89574679e47a41c440fc6c298c197fba1c314ec80bc647be6d9964dc23357054423aad22fda869e0e658f82b6f35ea6d93d074045

    • SSDEEP

      24576:eyUQBKaUoqjr16ZSUuxLWNEWE0k8g04mAGm/YpA+AK/zU:tqaUoqn1601xLWNxxkV9mAW

    Score
    10/10
    mysticredlinekukishinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks