Overview

overview

10

Static

static

3

winprofile

windows7-x64

7

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64802b822518e9531aa9bbe7b681e07f48b2865892d9605fb88566b5523f392f

  • Size

    357KB

  • Sample

    240701-fqahwazgqn

  • MD5

    44ceb5e892331709e7945eb77eb90c3e

  • SHA1

    d6df5f1394f2d00e398dafb14e87ddd8d6547ceb

  • SHA256

    64802b822518e9531aa9bbe7b681e07f48b2865892d9605fb88566b5523f392f

  • SHA512

    099c45ef14c6b36bf7dc3535b1ae7e0f7a9e5bc18f13860a3f6ddc9551febe2a90cc1ceb00ada6d85ad0e4ec691eb7960bc121b52c61df730e50d43de40e1734

  • SSDEEP

    6144:YUWmEaUHGYYbiDEvgmBGok2ZtTfvW+NUFLtq72XxTl/X8rfQvV+EMyHKIqNsLBTv:YtpaimbfW+NU/qwx5/srfQvV+EMyHKIF

Score
10/10
redlineinfostealerspyware

Malware Config

Extracted

Family

redline

C2

77.91.77.6:24186

Targets

    • Target

      64802b822518e9531aa9bbe7b681e07f48b2865892d9605fb88566b5523f392f

    • Size

      357KB

    • MD5

      44ceb5e892331709e7945eb77eb90c3e

    • SHA1

      d6df5f1394f2d00e398dafb14e87ddd8d6547ceb

    • SHA256

      64802b822518e9531aa9bbe7b681e07f48b2865892d9605fb88566b5523f392f

    • SHA512

      099c45ef14c6b36bf7dc3535b1ae7e0f7a9e5bc18f13860a3f6ddc9551febe2a90cc1ceb00ada6d85ad0e4ec691eb7960bc121b52c61df730e50d43de40e1734

    • SSDEEP

      6144:YUWmEaUHGYYbiDEvgmBGok2ZtTfvW+NUFLtq72XxTl/X8rfQvV+EMyHKIqNsLBTv:YtpaimbfW+NU/qwx5/srfQvV+EMyHKIF

    Score
    10/10
    redlineinfostealerspyware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks