redline | 3ee692779441b3a14699edc0f9ad269c58281d5735c570a9468f077739db26dd | Triage

Sharing

General

Target

f38d9b74c3608660961b92448d249323.exe
Size

1.3MB
Sample

200708-7t7fr84b4e
MD5

f38d9b74c3608660961b92448d249323
SHA1

2e48e08c75486a10eb463ee34826c9a2fc207e96
SHA256

3ee692779441b3a14699edc0f9ad269c58281d5735c570a9468f077739db26dd
SHA512

c7c076116ac62b89f8545247815c006d08b6a05112e39a1210956d4d48d97c33db38936dc19532244a715e26d2fa1b0cc6e8fc135f4150265a058f9a7dabaf0b

Score

10^/10

redline discovery evasion infostealer spyware trojan

Malware Config

Targets

- Target
  
  f38d9b74c3608660961b92448d249323.exe
- Size
  
  1.3MB
- MD5
  
  f38d9b74c3608660961b92448d249323
- SHA1
  
  2e48e08c75486a10eb463ee34826c9a2fc207e96
- SHA256
  
  3ee692779441b3a14699edc0f9ad269c58281d5735c570a9468f077739db26dd
- SHA512
  
  c7c076116ac62b89f8545247815c006d08b6a05112e39a1210956d4d48d97c33db38936dc19532244a715e26d2fa1b0cc6e8fc135f4150265a058f9a7dabaf0b
Score

10^/10

evasion spyware trojan discovery infostealer redline
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks for installed software on the system
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies system certificate store
  evasion spyware trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionspywaretrojandiscoveryinfostealerredline

behavioral2