General
-
Target
6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.zip
-
Size
2.3MB
-
Sample
241201-ynqfesvmaq
-
MD5
c9d32518f162a5ee02ae4df9020bbbbb
-
SHA1
f65de32c2b70017775a1f58151ed667f2e166e13
-
SHA256
61f3a2572f203c05366b5ddd6c208fe65b5e960f195689c456b742d7339c667c
-
SHA512
7c1c7cb14b6940e6de1b0e4feed346bf972b78a3d50465684a99026ec3ec445d69da140a0628288efbed96a64a873291866f9d4cc3ac5d76fd43243059031a16
-
SSDEEP
49152:4I6DIDvzEoyCm7j2ntPU1PUH2Nrvli4OK4Lzcm3Db5jFllwDa0S:jgDHf2FcpTOK413ZDW20S
Static task
static1
Behavioral task
behavioral1
Sample
6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
redline
tg
163.5.112.53:51523
Targets
-
-
Target
6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
-
Size
2.6MB
-
MD5
55e393da1714013720ddf266c7906f43
-
SHA1
91a636913604184c010c2d9e0b331a804a2c0ab4
-
SHA256
6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957
-
SHA512
40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a
-
SSDEEP
49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
SectopRAT payload
-
Sectoprat family
-
Xmrig family
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Defense Evasion
Impair Defenses
1Obfuscated Files or Information
1Command Obfuscation
1