Overview

overview

10

Static

static

3

062463e1ff...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    062463e1ffe4cfd9712e423045b47d10_NeikiAnalytics.exe

  • Size

    730KB

  • Sample

    240526-1xkyeade9y

  • MD5

    062463e1ffe4cfd9712e423045b47d10

  • SHA1

    e9b4d896aa5b7b5d353c5a168a40907d91b369d2

  • SHA256

    6053f77fbc3437a24bced00d99fc4a31a3ef156c3435ad2ab0804365ef325e2f

  • SHA512

    edf30f18ae3d41cbf8ae2d325b263e9dbcac0f88f01cddf2aeb111ee13f223dc6fde6d775942bb61a8a5f905a5acedbd4ad69b72b97a46bee6a5ebc89fc1ec5e

  • SSDEEP

    12288:iGly90f38fld3mFxtNdCRC8NlCecJtoH1nQr+3qKhFX4B:FyLR8LzCRC8NlgoHK+d/Xa

Score
10/10
redlinefurgainfostealerpersistence

Malware Config

Extracted

Family

redline

Botnet

furga

C2

83.97.73.128:19071

Attributes
  • auth_value

    1b7af6db7a79a3475798fcf494818be7

Targets

    • Target

      062463e1ffe4cfd9712e423045b47d10_NeikiAnalytics.exe

    • Size

      730KB

    • MD5

      062463e1ffe4cfd9712e423045b47d10

    • SHA1

      e9b4d896aa5b7b5d353c5a168a40907d91b369d2

    • SHA256

      6053f77fbc3437a24bced00d99fc4a31a3ef156c3435ad2ab0804365ef325e2f

    • SHA512

      edf30f18ae3d41cbf8ae2d325b263e9dbcac0f88f01cddf2aeb111ee13f223dc6fde6d775942bb61a8a5f905a5acedbd4ad69b72b97a46bee6a5ebc89fc1ec5e

    • SSDEEP

      12288:iGly90f38fld3mFxtNdCRC8NlCecJtoH1nQr+3qKhFX4B:FyLR8LzCRC8NlgoHK+d/Xa

    Score
    10/10
    redlinefurgainfostealerpersistence

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks