Overview

overview

10

Static

static

3

setup.exe

windows7-x64

3

setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup.exe

  • Size

    502KB

  • Sample

    240701-16r33sxaql

  • MD5

    b0cfe4185035fc751ed0a62b1a95af98

  • SHA1

    dc90ec29c5da5414702e9163ae0133d207608960

  • SHA256

    ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137

  • SHA512

    22d2dda36d5a7a1d29560db389b4811481c6ee39158903e5debc2a95a641929317a3d487cf138bc7e06c55dd05fdd92687159e81ed5fa5d9d18b5660e5c39c24

  • SSDEEP

    12288:R9Z5uG0VGH6CNq93+xYg1dSjBYSuBbT+g6:vlOGaCT7ZBBbq

Score
10/10
redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

77.105.135.107:3445

Targets

    • Target

      setup.exe

    • Size

      502KB

    • MD5

      b0cfe4185035fc751ed0a62b1a95af98

    • SHA1

      dc90ec29c5da5414702e9163ae0133d207608960

    • SHA256

      ef5d295050a33cb9c2bd069a90855c74df58d0f7f6238885b48a6422eb6da137

    • SHA512

      22d2dda36d5a7a1d29560db389b4811481c6ee39158903e5debc2a95a641929317a3d487cf138bc7e06c55dd05fdd92687159e81ed5fa5d9d18b5660e5c39c24

    • SSDEEP

      12288:R9Z5uG0VGH6CNq93+xYg1dSjBYSuBbT+g6:vlOGaCT7ZBBbq

    Score
    10/10
    redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerspywarestealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks