Overview

overview

10

Static

static

3

174047408D...75.exe

windows7-x64

7

174047408D...75.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    174047408DE41770494EF4CFDC6B4B75.exe

  • Size

    374KB

  • Sample

    240526-dwbl1sda7t

  • MD5

    174047408de41770494ef4cfdc6b4b75

  • SHA1

    be5d55981090e243d3fcf50195a4f8f52624d5c4

  • SHA256

    f10e15ec0b0ed8ea201ac5f07b1bf547d3c592d3b1a359f564c8dc717dfca690

  • SHA512

    45b818ce122388fca30146e1b788d30540da808adcd4881bae60026445896367ab6caeac6d082750703380e697a9dbaa1db9259660edfcdd2a518cb271a6ee58

  • SSDEEP

    6144:yauvUJRc8Xk96UudPq/KvhvhNTbFCUFyw0eOz0wDmz6E6NgYnMfhlD16Xd9Cnx:yaOUJDUZu2wbueyxZM6z8hlD1H

Score
10/10
redline6894345723_99infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

6894345723_99

C2

https://pastebin.com/raw/8baCJyMF

Targets

    • Target

      174047408DE41770494EF4CFDC6B4B75.exe

    • Size

      374KB

    • MD5

      174047408de41770494ef4cfdc6b4b75

    • SHA1

      be5d55981090e243d3fcf50195a4f8f52624d5c4

    • SHA256

      f10e15ec0b0ed8ea201ac5f07b1bf547d3c592d3b1a359f564c8dc717dfca690

    • SHA512

      45b818ce122388fca30146e1b788d30540da808adcd4881bae60026445896367ab6caeac6d082750703380e697a9dbaa1db9259660edfcdd2a518cb271a6ee58

    • SSDEEP

      6144:yauvUJRc8Xk96UudPq/KvhvhNTbFCUFyw0eOz0wDmz6E6NgYnMfhlD16Xd9Cnx:yaOUJDUZu2wbueyxZM6z8hlD1H

    Score
    10/10
    redline6894345723_99infostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks