redline

General

Target

71a395e91c86b4636cbdc5a962373294.exe
Size

661KB
Sample

210926-zvkn7afdb3
MD5

71a395e91c86b4636cbdc5a962373294
SHA1

33798cff60d6228d9194df5f60bfca5e6be11179
SHA256

150708169937ab48a2299f0e19112fdb01efd0233b984d85b647d96d06391bc5
SHA512

bf31795274e03a780c52cfa0214748cc12ce60462fcea295c739930111b818a6c1c904e50219d13cec86643eed7acf2b0b01493ac61add0806e952caaa4cb80f

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

Kanuckk

C2

205.185.123.105:20035

Targets

- Target
  
  71a395e91c86b4636cbdc5a962373294.exe
- Size
  
  661KB
- MD5
  
  71a395e91c86b4636cbdc5a962373294
- SHA1
  
  33798cff60d6228d9194df5f60bfca5e6be11179
- SHA256
  
  150708169937ab48a2299f0e19112fdb01efd0233b984d85b647d96d06391bc5
- SHA512
  
  bf31795274e03a780c52cfa0214748cc12ce60462fcea295c739930111b818a6c1c904e50219d13cec86643eed7acf2b0b01493ac61add0806e952caaa4cb80f
Score

10^/10

redline kanuckk discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine Payload

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2