General
- Target nitrogenerator.exe
- Size 2.7MB
- Sample260227-qv4ydsaw5f
- SHA256 751736b637f142637a3efa5a4c8ba281c949e5054656554931514e6f03642bfa
Malware Config
Targets
-
- Target nitrogenerator.exe
- Size 2.7MB
- SHA256 751736b637f142637a3efa5a4c8ba281c949e5054656554931514e6f03642bfa
Score10/10Cinoshi
Cinoshi stealer is part of Cinoshi project Malware-as-a-Service (MaaS) written in C#.
Cinoshi family
Detect Cinoshi payload
Modifies WinLogon for persistence
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
RedLine payload
Redline family
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1