redline | e7dfdd41672ae6df679ac773862c96b5779013862aa1c2379821ce89fdc81764

General

Target
hwid-changer-games-main.rar
Size 361KB
Sample260731-vesbwack71
SHA256 e7dfdd41672ae6df679ac773862c96b5779013862aa1c2379821ce89fdc81764
MD5 f1c1856f6a7e93cd2d3b0032a86365b7
SHA1 4f5528a412269c00d2b48fcce55157ada65e8d15
SHA512 a6a9106381b495b3fcc33b1e0ee282a855d31cf841f9924fa2110c123d5fc42a380ea801221ff43cf104b59a6f9619220c11651125486833f5b852f2fd53c7c1
SSDEEP 6144:qVmD2IDne0WTlE+whKefuPCWuIKnpmdHVhufIgPTQuIKnpmdHVhufIgPTg:qVmDJeTJ5whV9xCiIgPfxCiIgP0
TLSH
T1B47423D5AF1E4E4DA2D34FCEB39305A915834DE17EAE12D8644921C343FE84E4AD87A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

redline

C2

37.220.87.13:48790

Attributes

auth_value
1edd2fb73ce1cefef7757295d049e227

Targets

- Target
  hwid-changer-games-main/AMIDEWINx64.EXE
- Size 455KB
- SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
- MD5 9adfcdac59db3286690c7eede8da2528
- SHA1 0b54d251438a634bd13b49a1f20587cf03d4598d
- SHA512 fde1700cdb4212593ec2733944a169c7d02f436ca6831719a33482fbfd0be289697c9aa6ce7ddfb6c245e87952b35416929bbf69753d21a24197ac6c2d1243cc
- SSDEEP 6144:PRx1SY2XTh/Fq+1VU1/SznTh8NUc9v4/nOmNAFw+lgBwFejOLlC:PR/2N/I+rUqE9inOmNAFwa/TQ
- TLSH
  T1B0A4084AEB5224E0D876D1B8C981521AF6B0BC7847349BDB729C41090F76AEC9E3DF58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  hwid-changer-games-main/HWID Checker.bat
- Size 492B
- SHA256 2c88867fe0929b281ac86a0610119a09d773b94ecc4f63664f13f058f03602f1
- MD5 46040e2135e912f85c0cddb8b364d923
- SHA1 28bf68a37f0bf104b42427bdf9f661efbb2240a0
- SHA512 f154e9dd04f80b764129a6849ed33240c9d4684e36d0c25d4394278ff3a14c2e0b0876258da55d6e366bb69922d0b1e79725d6de5a7616031e3242c2bd8b3bfc
- TLSH
  T164F05E4BB65A86458D506E1036720491303D62A385D29DD87DB722385FD38DCB6DDF2F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral2
- Target
  hwid-changer-games-main/HardDiskSerialNumberChanger.exe
- Size 237KB
- SHA256 87fb385f96247a701a227e173041d47783befa873e8ab8ee9c886a918369fe00
- MD5 ecc630a923e295240c465000e939d897
- SHA1 d24ea1e7bc9b05312e31f05a26222ab4effd664b
- SHA512 d0425c7e69d5ba15903b40055ce0e72fc4b8fd59cf58018cc89fc2fe268739e3b470ca63db0b6fda7e0c87fbb70d207fbc9ae51ee607b33d494908437a825eb8
- SSDEEP 6144:QBTDgheuMo6jfztgkbwoWjG6aB3ZyCvrhF44bozBAMx1A7+gvo1:QZzjAhi6aB3ZyCvrhF44bozaMx1p
- TLSH
  T1F634D603BD9AC961C75CE432EC7F03DA806A259231EE185C8B1615CB793F7A05E3696F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery redline infostealer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Suspicious use of SetThreadContext
behavioral3
- Target
  hwid-changer-games-main/MAC Address Changer.exe
- Size 237KB
- SHA256 87fb385f96247a701a227e173041d47783befa873e8ab8ee9c886a918369fe00
- MD5 ecc630a923e295240c465000e939d897
- SHA1 d24ea1e7bc9b05312e31f05a26222ab4effd664b
- SHA512 d0425c7e69d5ba15903b40055ce0e72fc4b8fd59cf58018cc89fc2fe268739e3b470ca63db0b6fda7e0c87fbb70d207fbc9ae51ee607b33d494908437a825eb8
- SSDEEP 6144:QBTDgheuMo6jfztgkbwoWjG6aB3ZyCvrhF44bozBAMx1A7+gvo1:QZzjAhi6aB3ZyCvrhF44bozaMx1p
- TLSH
  T1F634D603BD9AC961C75CE432EC7F03DA806A259231EE185C8B1615CB793F7A05E3696F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery redline infostealer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Suspicious use of SetThreadContext
behavioral4
- Target
  hwid-changer-games-main/amifldrv64.sys
- Size 29KB
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- TLSH
  T1EFD23B92C6B45C87EEA3993162F4D263BD35B69237608ADF4026C0950F93BD1A73C369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  hwid-changer-games-main/cleaner.bat
- Size 5KB
- SHA256 cab883b4ae93e77e06f51ea422591a06b945479174884270005ae67353272f43
- MD5 b3c21fa1ccda2feecefb69b327441642
- SHA1 1ca39a22c49557f0ac177658efa9674300599c85
- SHA512 a7145449b795c2386fb1a9c5e0b320811d557a47b408f444c90eab7ffbcff7216e939f47a3eb26eecfdad4fd00b7be79c3082803822226702fc8215cf70ee0ce
- SSDEEP 96:lbVenI8xeMz8mqtVtHf1fYhSfxE8QYbI4Kc:lVenInMhqzxf1fYhSfCYbVKc
- TLSH
  T1F0C1C043196FC1A42A43D05A61655425D0ACA5EF771D03D2373EAABE02C5CACE8CFE7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

defense_evasion execution
behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: RedLine

RedLine payload

Suspicious use of SetThreadContext

Family: RedLine

RedLine payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6