redline

General

Target
85B893E662B72F5B13DCF68FB02DAB2D.exe
Size 684KB
Sample210525-c4fa29xle2
SHA256 29200e3f6bdfb998471d4fa7c04a49c95b3de5a26197246d1f37c3dcecaa969b
MD5 85b893e662b72f5b13dcf68fb02dab2d
SHA1 304bbcbd4fb0090eaa05f16abdd74edfa7cbbea9
SHA512 59dcc1434d7f7f15b2204d34e16f94e54b1cc394a9ca125ec242f076772705a4a415e422848930969a268b86a0e8d2e6059fd95569898f6aba680f60b7cfb508
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

Vudus

C2

80.92.204.95:59766

Targets

- Target
  85B893E662B72F5B13DCF68FB02DAB2D.exe
- Size 684KB
- SHA256 29200e3f6bdfb998471d4fa7c04a49c95b3de5a26197246d1f37c3dcecaa969b
- MD5 85b893e662b72f5b13dcf68fb02dab2d
- SHA1 304bbcbd4fb0090eaa05f16abdd74edfa7cbbea9
- SHA512 59dcc1434d7f7f15b2204d34e16f94e54b1cc394a9ca125ec242f076772705a4a415e422848930969a268b86a0e8d2e6059fd95569898f6aba680f60b7cfb508
- MD5 SHA1 SHA512
Score

10^/10

redline vudus infostealer spyware
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Executes dropped EXE
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine Payload

Executes dropped EXE

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2