redline | 215fe6cb15f087bb8c0b5e33437317cb94bd8902bd3027aeadcda78329518441 | Triage

Sharing

General

Target

215fe6cb15f087bb8c0b5e33437317cb94bd8902bd302.exe
Size

100KB
Sample

210731-fpbjlyp1vs
MD5

8b8bd25f4ae51c193f117f15e9bbb888
SHA1

1090b3a7b6dd1beae67f7d7771af8ab3534991d7
SHA256

215fe6cb15f087bb8c0b5e33437317cb94bd8902bd3027aeadcda78329518441
SHA512

df5867515abceb1f6e931bb6d7f367e8202d43d456f1fc7cd3b3ccd6526bfc7c22701b931b684042819c40cbc8cafe8e3abf4a4215c686b5afc33ff7f4a738aa

Score

10^/10

redline 3 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

3

C2

213.166.68.170:16810

Targets

- Target
  
  215fe6cb15f087bb8c0b5e33437317cb94bd8902bd302.exe
- Size
  
  100KB
- MD5
  
  8b8bd25f4ae51c193f117f15e9bbb888
- SHA1
  
  1090b3a7b6dd1beae67f7d7771af8ab3534991d7
- SHA256
  
  215fe6cb15f087bb8c0b5e33437317cb94bd8902bd3027aeadcda78329518441
- SHA512
  
  df5867515abceb1f6e931bb6d7f367e8202d43d456f1fc7cd3b3ccd6526bfc7c22701b931b684042819c40cbc8cafe8e3abf4a4215c686b5afc33ff7f4a738aa
Score

10^/10

redline discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinediscoveryinfostealerspywarestealer

behavioral2

redlinediscoveryinfostealerspywarestealer