redline

General

Target
d525085a2cb44793da2427fba25a3075.exe
Size 297KB
Sample210818-esqf5cf4nn
SHA256 0db83610da33951f31a2d68fd9a758f389775d3c489886eb9d7d598b5343b4e4
MD5 d525085a2cb44793da2427fba25a3075
SHA1 20244b9171adb2ffef937209cd1d8be457fbbeb2
SHA512 1eda02fdb1ebed80e49c9fd7e9f3995bd92a17118d057cdea91ce6d82810722b0bed9a2b2115bc77f783d4f598ddfa6db8cb0fb1aaf6bbcc3a549bdaacbbcb54
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

redline

C2

185.215.113.29:8889

Targets

- Target
  d525085a2cb44793da2427fba25a3075.exe
- Size 297KB
- SHA256 0db83610da33951f31a2d68fd9a758f389775d3c489886eb9d7d598b5343b4e4
- MD5 d525085a2cb44793da2427fba25a3075
- SHA1 20244b9171adb2ffef937209cd1d8be457fbbeb2
- SHA512 1eda02fdb1ebed80e49c9fd7e9f3995bd92a17118d057cdea91ce6d82810722b0bed9a2b2115bc77f783d4f598ddfa6db8cb0fb1aaf6bbcc3a549bdaacbbcb54
- MD5 SHA1 SHA512
Score

10^/10

redline discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine Payload

Reads user/profile data of web browsers

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2