Overview

overview

10

Static

static

1

avira_spot...up.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    avira_spotlight_setup.exe

  • Size

    34.2MB

  • Sample

    241204-x5lm5axkgx

  • MD5

    972eb9126d92fea2626690bef903aad6

  • SHA1

    9def5004dc267f77f5cfb7070e85d330b8e33638

  • SHA256

    858c355a5723e866dd9379765f2672976b4a097d836e8b5a2cd865f9819492a2

  • SHA512

    2283f4ab903c98ccfb0a79154d5ad32b4af1ac4e8e7d71d583bbdbbd0ca866449e6c7658a8ac6b1e6061c448fa34e3b0a84b84efc023e5b2c80ca71c6aeb048a

  • SSDEEP

    786432:CxgDPaSv7Kbd46LHeyvLXGx5ncGmGGxqe6PqiDViD:JKbd46bC5ncz/xy7DVo

Score
10/10
redlinediscoveryexecutioninfostealerpersistenceprivilege_escalation

Malware Config

Targets

    • Target

      avira_spotlight_setup.exe

    • Size

      34.2MB

    • MD5

      972eb9126d92fea2626690bef903aad6

    • SHA1

      9def5004dc267f77f5cfb7070e85d330b8e33638

    • SHA256

      858c355a5723e866dd9379765f2672976b4a097d836e8b5a2cd865f9819492a2

    • SHA512

      2283f4ab903c98ccfb0a79154d5ad32b4af1ac4e8e7d71d583bbdbbd0ca866449e6c7658a8ac6b1e6061c448fa34e3b0a84b84efc023e5b2c80ca71c6aeb048a

    • SSDEEP

      786432:CxgDPaSv7Kbd46LHeyvLXGx5ncGmGGxqe6PqiDViD:JKbd46bC5ncz/xy7DVo

    Score
    10/10
    redlinediscoveryexecutioninfostealerpersistenceprivilege_escalation

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Creates new service(s)

      persistenceexecution

    • Checks for any installed AV software in registry

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

1
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks