Extracted

Extracted

• • Target

    RedEngine/RedEngine.exe

  • Size

    8KB

  • MD5

    4fbb04c9e3aa983cbfc4980a7b5b7041

  • SHA1

    34aeca658462e638521bc384a4935251678a9a78

  • SHA256

    24f095f4f5796561cc9f9c60f71a2182fee89692f239c92e7447af3461e12731

  • SHA512

    615534039ad97fea8c881656a53b6b0ead41e3770e0a3f3cd38052585dc5a102ab25b824c59c3142b75f6b62e56ff46ab981e27c889ded28a5cc2884581863bc

  • SSDEEP

    192:Gh9Lz2jG4pFMYqLDQ1bhxZzzzhGjcJr9emxan6+UqawcTnYPvkVNxdpD:Gh9Liy4kLDQHtGjcJrQmxan6+/xcTnYg

  Score

  10^/10

  defense_evasionredlinecredential_accessdiscoveryexecutioninfostealerpersistencepyinstallerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2

• • Target

    RedEngine/libEGL.dll

  • Size

    469KB

  • MD5

    2a568dc1f848b2948dfd90c8ebeb58c6

  • SHA1

    e765ca8946ce091651c6722c650d9ad5edfeb5d5

  • SHA256

    c00285c0174024739997898e98444deb4cbfe6b571cca69ca3bf8e5ab3ea5bbe

  • SHA512

    a6ce4ead89933d32ea24766f887655ee5894ef1813faf97ebb2191a775488ba2fd77bcb4aedefc273ef85f5a93a9a5dd3d35b213a52d95b0cc4111708d9fcee5

  • SSDEEP

    3072:4kgdNXYPuSHGjFXVYbAQSIoU8w1Z5iErbFdWE7D6i/wZJothADZX+Lcq7gv+xt4f:47Vl/HxUniSbFdH1/wXFufMG9x2qPz

  Score

  1^/10
  behavioral3behavioral4

• • Target

    RedEngine/libGLESv2.dll

  • Size

    7.2MB

  • MD5

    5afc7b4ae2a76fa9a2b740734ef9f9f7

  • SHA1

    fb7d539a77883ee2ad2036c0243ef9acb49132ab

  • SHA256

    9168eac79d66301f49c8b2d501e8ea79b52f6b3f8b4e6aac06348fe24bf845d6

  • SHA512

    132ed0e481192f31e5aedde4f4386beac099c8ce86778b097b98cbd7ada6e7fcf15cda271b0ec07bab4edbb9429937ea9aae139d6ba7b74a4f4238471d8ea773

  • SSDEEP

    98304:vD+WTl1xDfbWziTwMPdkUqqXyXm3C/0+:vDTnxezkPqqiCC/

  Score

  1^/10
  behavioral5behavioral6