redline

General

Target
2093d467e65e9dbad2a55577d9f8d396
Size 100KB
Sample210817-3repgphh5s
SHA256 3de11e9ba2b8db6be4069506a95bc31250d8ae8d0df5e8fec66121a05f1ccbc6
MD5 2093d467e65e9dbad2a55577d9f8d396
SHA1 c1e80273574c80a82b90d021212d784c7a90ee4a
SHA512 b2a394cb9f444b14114d976745f2b36301a2b17954963fb8c54f384d9c069bfea5c05f2840f733d0a6eee12d643e02a4fe19eefa64195b73a32e5d53e9cbb920
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

@JABKA9983

C2

51.89.92.99:5965

Targets

- Target
  2093d467e65e9dbad2a55577d9f8d396
- Size 100KB
- SHA256 3de11e9ba2b8db6be4069506a95bc31250d8ae8d0df5e8fec66121a05f1ccbc6
- MD5 2093d467e65e9dbad2a55577d9f8d396
- SHA1 c1e80273574c80a82b90d021212d784c7a90ee4a
- SHA512 b2a394cb9f444b14114d976745f2b36301a2b17954963fb8c54f384d9c069bfea5c05f2840f733d0a6eee12d643e02a4fe19eefa64195b73a32e5d53e9cbb920
- MD5 SHA1 SHA512
Score

10^/10

redline discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2