Overview

overview

10

Static

static

3

0848e1e7e1...63.exe

windows10-2004-x64

10

1106a57fdf...a5.exe

windows10-2004-x64

10

185a521367...e2.exe

windows10-2004-x64

10

1a2ed241f7...81.exe

windows10-2004-x64

10

3933af1a19...66.exe

windows10-2004-x64

10

4046412564...e5.exe

windows10-2004-x64

10

48b2c44ad3...cf.exe

windows10-2004-x64

10

6fdb50a007...59.exe

windows10-2004-x64

10

708b7d578b...65.exe

windows10-2004-x64

10

73dc042440...3f.exe

windows10-2004-x64

10

9a45e9c206...55.exe

windows10-2004-x64

10

9a8f8e9a46...09.exe

windows10-2004-x64

10

9ab135934b...fe.exe

windows10-2004-x64

10

ab010a807d...38.exe

windows10-2004-x64

10

b85fd724a0...c4.exe

windows10-2004-x64

10

d940f9b9c6...49.exe

windows10-2004-x64

10

dc87cba915...e1.exe

windows10-2004-x64

10

e7bd826b7a...05.exe

windows10-2004-x64

10

ffbf9f9530...19.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    r.zip

  • Size

    11.7MB

  • Sample

    240523-lm928acb9z

  • MD5

    10edb3a9a699a05bf22065c503182388

  • SHA1

    9bdda0e1d1a80c47627ef96451324f0e275ab2ef

  • SHA256

    d66c5907218da0e1082f3a1318226d1c5bab6bd1ebb57b034a817b4c35495ac8

  • SHA512

    fc2b3a0da1d6784f68826fc19483c515c00e3a61f106258f7605bd38f665b6e99e6ee965d6105654e29d4e175bc0c1b24d0f65a57cb370d345e546e37ffe7058

  • SSDEEP

    196608:YO0bIQ5jVlm5PP6eauQtYeOdFduf9XLKJcRN4qNB9YdKQIeerRuHcSFGXPfyC:70b7DmxP6aQK5dqlLKJcou7Y8hrUHvFS

Score
10/10
amadeyhealermysticredline59b440fb0fb8kinzaluatemrakdropperevasioninfostealerpersistencestealertrojan

Malware Config

Extracted

Family

redline

Botnet

luate

C2

77.91.124.55:19071

Attributes
  • auth_value

    e45cd419aba6c9d372088ffe5629308b

Extracted

Family

amadey

Version

3.87

Botnet

59b440

C2

http://77.91.68.18

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

  • url_paths

    /nice/index.php

rc4.plain

Extracted

Family

redline

Botnet

mrak

C2

77.91.124.82:19071

Attributes
  • auth_value

    7d9a335ab5dfd42d374867c96fe25302

Extracted

Family

amadey

Version

3.89

Botnet

fb0fb8

C2

http://77.91.68.52

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

  • url_paths

    /mac/index.php

rc4.plain

Extracted

Family

redline

Botnet

kinza

C2

77.91.124.86:19084

Targets

    • Target

      0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63

    • Size

      534KB

    • MD5

      3c37c9dee739aadac42bb79609804a88

    • SHA1

      825fc8f20b26c3a6a0b14656ccaac4e616cac2f3

    • SHA256

      0848e1e7e128d7f1f97806b2608b355879b602ba08e121497f133be212790f63

    • SHA512

      c65f00987ef863db518fce5e3c73ec821d2a743b83544b96100d3388e00641d8153bfc96e29839844cd94d48fda513cae2966627c8a6881eb84cb6a8ff0022a2

    • SSDEEP

      12288:/Mrwy90l5dDCl5EZ+oNfInGuks/c6+fB5KsUPK7TiumGBESu:PyfHEMiInGukgIB8sBOwBEL

    Score
    10/10
    redlineluateinfostealerpersistence

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

    • Target

      1106a57fdfdae9114d2bb44bdacc87ca3cae04161d58f6a7da3ec41e1aa098a5

    • Size

      1.2MB

    • MD5

      3dbb95f86f886cdbafb2d8989c1cc77c

    • SHA1

      f0c053c9b02c0cd21a321ce5c57950b0040c7aa7

    • SHA256

      1106a57fdfdae9114d2bb44bdacc87ca3cae04161d58f6a7da3ec41e1aa098a5

    • SHA512

      a0aa590779c2f4e6c4dc3c360047623c5e919eac9219b252c74d634a7f5e654ac1d265e7b18a9783daa722f7c59fd351b3084f7deccbae09dad6ae493cb38683

    • SSDEEP

      24576:syYxMgtVHWO2xYNKZPT1VXEFgb8vjy3s8mHUYIzq3ga/6dPy4a6zri:bYxMgtNW9aNKZPT0Fgb8m3qHUZW9iI4H

    Score
    10/10
    mysticredlinemrakinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral2

    • Target

      185a521367840914ea4a144255106961422396c5ca90144e322e12b70a4598e2

    • Size

      763KB

    • MD5

      c87f8ff64e9000e767665d356dbcb9ef

    • SHA1

      6da2c45e0fc331217c7c4e0c0cbe2aef2021b8bb

    • SHA256

      185a521367840914ea4a144255106961422396c5ca90144e322e12b70a4598e2

    • SHA512

      17fa5456f8eb8f27b3df49b292110ee5d39cf7f35ec35ee6c2e7ac2cfe37aea42239e369bb4d80ed54abdc4f4f7ab0f46ffc4e65392d1b8013697490b1978c4f

    • SSDEEP

      12288:bMrqy90RuT/1uY7zF2LN18cH8iysFAlFJMiu68twFZ1Pfir:hynT/1D2LN1UsFKMikcfir

    Score
    10/10
    mysticredlinekinzainfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral3

    • Target

      1a2ed241f75ba217ad63fa42ab55e56d8f009f93b151dd367b73459e26169081

    • Size

      759KB

    • MD5

      da65ecd0dd929d1a51b4a306ee005289

    • SHA1

      a109353f18e52c495a522d2e26fc5596478222c9

    • SHA256

      1a2ed241f75ba217ad63fa42ab55e56d8f009f93b151dd367b73459e26169081

    • SHA512

      6b59bc5578e22dec313d8e90199a1892fc2e3455001440a76b70ebb97fd6dcb310f45cf17cf417cdec02750ce1548a49f083dde105ce43f38de0d69be9946a53

    • SSDEEP

      12288:NMrBy902NCTgXGeV8LTNVQ9vLrUHopYACumX/Yjva8KbvsZzo4BEpu+LnK+FI6y:wyn0/UQNVMMHAouIgG8KIO4BGu48n

    Score
    10/10
    mysticredlinekinzainfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral4

    • Target

      3933af1a190b049a02aad532333dad6c4862e46b510cc0ec5184873641cc3166

    • Size

      599KB

    • MD5

      f1284840a75dea598b56fd2b113b57d7

    • SHA1

      63abdc9a19ea7543b44b3180ae7fa3a68d304763

    • SHA256

      3933af1a190b049a02aad532333dad6c4862e46b510cc0ec5184873641cc3166

    • SHA512

      7a827fa3325db78413e5c719df7b0d8d897be2c965499395f8a0c65d2ff3df1cba7bb07dd2ce5f70f138255453453229bede7fb16276567413a4c52f76c1aea3

    • SSDEEP

      12288:MMr8y90aStQnEVRLQxQCwIExpmvo++PKjfRBer1nuoCKC7LX3HI/7p:YybEnLxCwIExpfhKjfRBerZJCKCnXI/t

    Score
    10/10
    amadeyhealerredline59b440mrakdropperevasioninfostealerpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral5

    • Target

      404641256449db604d1af955269cb455aa5a4441ca5e7f6276ca15f5886535e5

    • Size

      761KB

    • MD5

      216c4829a35a74ecacf925e3d47f46cc

    • SHA1

      3792b2f30a7237382361cae16251ced767d973fd

    • SHA256

      404641256449db604d1af955269cb455aa5a4441ca5e7f6276ca15f5886535e5

    • SHA512

      c4ac9a5edd6200a7734a5fc2048ab52d974516e3a8607c3113dd38fca253adf6aee950b9adaa06ee9b923eeb694c8f2899790eaa19d8b995102473229c8adf15

    • SSDEEP

      12288:LMrdy90rTPMHf9/WOfbJ2lkpZUAHwTHOXSVAsAwCGPjcfMgNLW7Wnbq9KsHfo:GyGPMHfp3DJppmAaHOXcMijcfMg1Wosw

    Score
    10/10
    mysticredlinekinzainfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral6

    • Target

      48b2c44ad346117214bc572f969741dfa0acfcd1fc6e23b00cdeb324c9f00fcf

    • Size

      760KB

    • MD5

      01b54142bbcbf358e7bb4cf4adc4d84d

    • SHA1

      c29ec93bbe01df3aa05cf740226cf47761f1ed8e

    • SHA256

      48b2c44ad346117214bc572f969741dfa0acfcd1fc6e23b00cdeb324c9f00fcf

    • SHA512

      8cb07cee09caa55ea55bac3398c075b2a5dc3e03e5431572fffbd4b06b406cc41138db1a2c6a0f701d0d870479adb438860c41e1d81aeb0022eb1f35503618ba

    • SSDEEP

      12288:AMrZy90MUAe2aL1UeyNwMewZMdNRoNSZPIaZpP7YlAQJI1C:Jy/UAnaZXj+qLRwlaZe+QJAC

    Score
    10/10
    mysticredlinekinzainfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral7

    • Target

      6fdb50a0079a54fd2c8a1914519edb8a2bee5d2cd01893a926c2b2b6fbb08759

    • Size

      496KB

    • MD5

      9aef86abcad029040fa01e67befa91f9

    • SHA1

      9dcbf47ce36595b3eefe59bb1ea833ae5e9d5065

    • SHA256

      6fdb50a0079a54fd2c8a1914519edb8a2bee5d2cd01893a926c2b2b6fbb08759

    • SHA512

      929d5efbf2ed51ded7b4d9a0a3c98cfb6ae8c6142e2dcb7f890e3d61243172d7efb24a367ad10165800dc96ac810fb204a9f3de239ff395e94f6305152af88b7

    • SSDEEP

      12288:wMrty90BxdBF3rKeE9ITD0lIfcVLpOrxf5++O/:Ny4/BFVEzIBrxfg

    Score
    10/10
    healerredlinemrakdropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral8

    • Target

      708b7d578b1052d5139aa1c7696980dfbb558c7f9d79340c923242e497b33165

    • Size

      913KB

    • MD5

      dca929d746fbc57599fd90882325f030

    • SHA1

      c3374249560ea2019d57b288aef67906e1c5285e

    • SHA256

      708b7d578b1052d5139aa1c7696980dfbb558c7f9d79340c923242e497b33165

    • SHA512

      617458913f5dfb76ed23c605c772a8da48f6905df2f2b46077dc810310d29ba64a334a455f360b815eab93cbf2130fe84ec8177fe099775f45319f9ba0a0896a

    • SSDEEP

      24576:YyS5nbWGFJT6uokW0rDd4Q1LG//kXs60r31PeC7:fS5rJ91rDqv/vhrlPeC

    Score
    10/10
    mysticredlineluateinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral9

    • Target

      73dc042440fa05b66d753f67af4b8f08d529e3c6a45d57710b9b74505441e13f

    • Size

      1.1MB

    • MD5

      7f58d8caedf6979bee301182a64a19bd

    • SHA1

      b772e45e5ca373a2ee2e081b8f8645b25699d610

    • SHA256

      73dc042440fa05b66d753f67af4b8f08d529e3c6a45d57710b9b74505441e13f

    • SHA512

      fdcb426e044be7279c2958b89b6423b5e5d6cf9ab2cc58213ac885b5a8a7a8d2a30a63dbfa924c201068ad07612ab50244726e407be616896b3d2491a1a70455

    • SSDEEP

      24576:CywoOMiEqHorKYErxslRGgHTqqEwg28UJZTiR:pw8iE4qKYErCgIgDUe

    Score
    10/10
    amadeymysticredline59b440mrakinfostealerpersistencestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral10

    • Target

      9a45e9c2060aa38e5c0bd25ef98f2a3acb0c464207b459fa09e6fe8492e26755

    • Size

      234KB

    • MD5

      45e93a000b07f25fe943fdf1f7b65357

    • SHA1

      87725546f53447d680f47e63a0cc581dcd4503fa

    • SHA256

      9a45e9c2060aa38e5c0bd25ef98f2a3acb0c464207b459fa09e6fe8492e26755

    • SHA512

      83cb89078894b96f0bf1f7a8ef6b2983d7e21f60bd575004772267424c4603b75e18f9f805535634a9678aa58494f25eb83fdfc36553f25b3c80bdd4691b2c6d

    • SSDEEP

      6144:KBy+bnr+2p0yN90QEHBKyBErKK+iBI/cl:/Mryy90ZxBEz+iBIEl

    Score
    10/10
    amadeyhealerfb0fb8dropperevasionpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral11

    • Target

      9a8f8e9a46ecd10ddf934650a91f96319970ec135841d45623f9d76ab3171009

    • Size

      476KB

    • MD5

      eb39a2b3c68d99216a38cb0593f82005

    • SHA1

      c50ccd4606ad7793cd469ceb9609974f942778f9

    • SHA256

      9a8f8e9a46ecd10ddf934650a91f96319970ec135841d45623f9d76ab3171009

    • SHA512

      87c900f447fc115cb79ff8597fa01705ffe8bba0bfe7a8b42a51ff69a949f9d67c13ff9240946aa9d300c90ef397488762563ebb0e1120463602708d996e03db

    • SSDEEP

      12288:VMrAy90EDRCEym1LQ9KRwEXYp7G9TnJQ3Ckltu3:JytRtZQ9KqEABg3

    Score
    10/10
    amadeymysticredline59b440mrakinfostealerpersistencestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral12

    • Target

      9ab135934b017c0850bc323f91ac4cecbc3640903406ed3576ec0747ded9e6fe

    • Size

      373KB

    • MD5

      288cac03ce7b5c3aa5272c2f90620147

    • SHA1

      610d6ea082a6dcac1812a8fcf7654fde3e807ec7

    • SHA256

      9ab135934b017c0850bc323f91ac4cecbc3640903406ed3576ec0747ded9e6fe

    • SHA512

      e48b31059b16d3bb4792be2c17d0d814bd5a1ce9b7669408f2df17675a113e6a7adb7f64a20740ed13077f75efc7c6a4f2f82534d6b61294775c9bff078ac047

    • SSDEEP

      6144:Kyy+bnr+Vp0yN90QE9WhSSFCpPTbTenECVcZ6rV1YC1wjZXwcuXLfbaHVT:SMr1y90/uZ0rbAV1xwZwcubgJ

    Score
    10/10
    mysticredlinemrakinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral13

    • Target

      ab010a807d239acb2941ec42032df7751afe90303b101088fee9d258794e4a38

    • Size

      507KB

    • MD5

      2e5330889062fcf0d84486969121769f

    • SHA1

      6a5d56c39f33daf782507d31fc4b4e47df9981c3

    • SHA256

      ab010a807d239acb2941ec42032df7751afe90303b101088fee9d258794e4a38

    • SHA512

      3f96cc3f0c01e83dfefee7717a32d6c3077c79176ba68cd9ba0f783503db7d7ea5b91fd242d915b88becd4d4ebeb1c147af706798373f21d7cc0b590213f85c1

    • SSDEEP

      12288:CMrBy90xjSnk0tswyfz4eLx/6TLYrFT5A0FiTZVq:Dy2uinf3Q0rYh3q

    Score
    10/10
    mysticredlinemrakinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral14

    • Target

      b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4

    • Size

      829KB

    • MD5

      1b57155273f2fd6a1393db1c43bbca12

    • SHA1

      2a83532f4c0eb909b7dd5e17ba6d96000a951c32

    • SHA256

      b85fd724a0f0185fdd32093b1f07f4f209b862b9406e12882311cd820c17cac4

    • SHA512

      73ae095fc68b9b9dc8154d5875c4ab7e284eed5dc6b55404ed47aaccf111f3ff5c2710d91093d89ee541c16a97daa2b9d74a4635c05453584a40a5f60cf726fc

    • SSDEEP

      12288:qMriy90KjSj6O8hnnZgzVIQINDwaeAcJSJ3q91uTuhXWqlQmsWxGd6zluo:AyjjtGzxKDDJ3q91VhXHbVlP

    Score
    10/10
    amadeyhealerredline59b440mrakdropperevasioninfostealerpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral15

    • Target

      d940f9b9c60fd13aa5272fd2a69f035a8a08c097f0ed72b29431278d2fc4a849

    • Size

      761KB

    • MD5

      4a01abacf29d457359df733251113c91

    • SHA1

      b4ad19178b21c759bf8bf5676a435aa4b00b5e5e

    • SHA256

      d940f9b9c60fd13aa5272fd2a69f035a8a08c097f0ed72b29431278d2fc4a849

    • SHA512

      99da8748c8593756f22ada15415c9bb7e79f03796b28bf8b56479cfd7c4a715eb239ec9e0d83f044cbdaadadad8c71f4886ed01bd439ac444dc8219032dd277d

    • SSDEEP

      12288:SMrWy90UWJTYhBFqL/iQlnlo07S7g/0dMJ6krt4Mr1W40PbyXTvhZHJ:EydPQDVlo07qQ0642tr1SbyXT5Zp

    Score
    10/10
    mysticredlinekinzainfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral16

    • Target

      dc87cba915fb6101c577a0531cedb5d304be24abd22d9faa34b7a606ccc5f8e1

    • Size

      643KB

    • MD5

      ff1d1ab6fe52c810fe4abf9552b69e9a

    • SHA1

      3472a8f8d5d1d93765c85d242ebf1c043966739a

    • SHA256

      dc87cba915fb6101c577a0531cedb5d304be24abd22d9faa34b7a606ccc5f8e1

    • SHA512

      4d8cf50d9c5dfc6a669a8914b2a6ada01c90f21a7bb113cfcd256bf796267de14d139d060876ebf1dd87cf8bf81378389f5b2ac74e11143b28881978a804629d

    • SSDEEP

      12288:sMrpy90UGsoYRiX8Oo/GehZL0Kk5xAkak1HSmapBPBWztYhCvQ5w+1:9y3FW8ntUJ5xAkFp5ajBWza35

    Score
    10/10
    redlinekinzainfostealerpersistence

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral17

    • Target

      e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05

    • Size

      396KB

    • MD5

      dc84eacc27933a0db96d90c12de60717

    • SHA1

      3a646269f3e30b522598ccb2aa18bf4c115cf89b

    • SHA256

      e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05

    • SHA512

      2b51577ffc104848fdcfce1c3ee63c4c708d3d79f9e21f2696e7360ded105c0be9d3ccff515f6944c6df17bdaef6ebeac2847e70eb451efc784060ccf9643f6c

    • SSDEEP

      12288:oMrly90p3B0Wf5Gr0azGyQIh8Ak/61zcOjV/5oBN:dyI0WS0Fycuae15oBN

    Score
    10/10
    mysticredlineluateinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral18

    • Target

      ffbf9f9530a3dc84123d1e676feb925ea3c13cf2876d58672bb23f55afe1ba19

    • Size

      599KB

    • MD5

      99fd0b2ec905c3e08b6ab6c8adaf3a4e

    • SHA1

      147be259f83e1f4c2e739d390d4a8a72e8373ee4

    • SHA256

      ffbf9f9530a3dc84123d1e676feb925ea3c13cf2876d58672bb23f55afe1ba19

    • SHA512

      56a943334d09307861f8f74ef7e858ede2eed15e06dcb2d271938a1eed1039c3ea34811c20965c455ef62b39ca9a2f899e4c559ca420041df28cd022f636705c

    • SSDEEP

      12288:GMriy90WiusxhjG8E57oii214aklgzzfcvrjSnKlkcw63IwJwd:AyTEGv57oiiS4abIvr0KJ3Iww

    Score
    10/10
    amadeyhealerredline59b440mrakdropperevasioninfostealerpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral19

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

7
T1053

Persistence

Boot or Logon Autostart Execution

19
T1547

Registry Run Keys / Startup Folder

19
T1547.001

Scheduled Task/Job

7
T1053

Create or Modify System Process

5
T1543

Windows Service

5
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

19
T1547

Registry Run Keys / Startup Folder

19
T1547.001

Scheduled Task/Job

7
T1053

Create or Modify System Process

5
T1543

Windows Service

5
T1543.003

Defense Evasion

Modify Registry

29
T1112

Impair Defenses

10
T1562

Disable or Modify Tools

10
T1562.001

Credential Access

Discovery

Query Registry

7
T1012

System Information Discovery

14
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

redlineluateinfostealerpersistence
Score
10/10

behavioral2

mysticredlinemrakinfostealerpersistencestealer
Score
10/10

behavioral3

mysticredlinekinzainfostealerpersistencestealer
Score
10/10

behavioral4

mysticredlinekinzainfostealerpersistencestealer
Score
10/10

behavioral5

amadeyhealerredline59b440mrakdropperevasioninfostealerpersistencetrojan
Score
10/10

behavioral6

mysticredlinekinzainfostealerpersistencestealer
Score
10/10

behavioral7

mysticredlinekinzainfostealerpersistencestealer
Score
10/10

behavioral8

healerredlinemrakdropperevasioninfostealerpersistencetrojan
Score
10/10

behavioral9

mysticredlineluateinfostealerpersistencestealer
Score
10/10

behavioral10

amadeymysticredline59b440mrakinfostealerpersistencestealertrojan
Score
10/10

behavioral11

amadeyhealerfb0fb8dropperevasionpersistencetrojan
Score
10/10

behavioral12

amadeymysticredline59b440mrakinfostealerpersistencestealertrojan
Score
10/10

behavioral13

mysticredlinemrakinfostealerpersistencestealer
Score
10/10

behavioral14

mysticredlinemrakinfostealerpersistencestealer
Score
10/10

behavioral15

amadeyhealerredline59b440mrakdropperevasioninfostealerpersistencetrojan
Score
10/10

behavioral16

mysticredlinekinzainfostealerpersistencestealer
Score
10/10

behavioral17

redlinekinzainfostealerpersistence
Score
10/10

behavioral18

mysticredlineluateinfostealerpersistencestealer
Score
10/10

behavioral19

amadeyhealerredline59b440mrakdropperevasioninfostealerpersistencetrojan
Score
10/10