Overview

overview

10

Static

static

3

RFQ 100463...28.exe

windows7-x64

10

RFQ 100463...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

  • Size

    2.3MB

  • Sample

    240628-hjmwqswdnd

  • MD5

    0b57430159e81d152455d3d2936f44e0

  • SHA1

    245c53304354ad8c703b2dd4fce1cc1ec46573bb

  • SHA256

    bea6547e13a91dea30b43f7b50a6e95d8cbc285c9a2c397fa52d17ce8351cc30

  • SHA512

    c70103e599a534bd6aad4238df567223fc4d2a7b07632be09c42ea2f46e3c941523ead3b3ee27abe72445ded4e33a646421a176d82fab637b4b500782b629f40

  • SSDEEP

    49152:IF50a6aPVOFMx3SmroCZscivbS6mqxEWoKmqZJffp3vSsqPUYeaw1GlNOmTCbCuF:KroA7PxBOb

Score
10/10
redlinefozexecutioninfostealerspyware

Malware Config

Extracted

Family

redline

Botnet

foz

C2

195.10.205.102:1912

Targets

    • Target

      RFQ 10046335 PO 4502042346 PR 11148099 411128.exe

    • Size

      2.3MB

    • MD5

      0b57430159e81d152455d3d2936f44e0

    • SHA1

      245c53304354ad8c703b2dd4fce1cc1ec46573bb

    • SHA256

      bea6547e13a91dea30b43f7b50a6e95d8cbc285c9a2c397fa52d17ce8351cc30

    • SHA512

      c70103e599a534bd6aad4238df567223fc4d2a7b07632be09c42ea2f46e3c941523ead3b3ee27abe72445ded4e33a646421a176d82fab637b4b500782b629f40

    • SSDEEP

      49152:IF50a6aPVOFMx3SmroCZscivbS6mqxEWoKmqZJffp3vSsqPUYeaw1GlNOmTCbCuF:KroA7PxBOb

    Score
    10/10
    redlinefozexecutioninfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks