Description
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
09a9d0ac201018bb7db76dc4fd5ced1d4663720578e4a3f3cae696986e99eed8
General
Target
Size
Sample
09a9d0ac201018bb7db76dc4fd5ced1d4663720578e4a3f3cae696986e99eed8
405KB
211125-vbddjsbbf6
Score
10 /10
MD5
SHA1
SHA256
SHA512
010d09ac20e9c512b1d3e0a4cdc4ecd7
c3c0a152c2e1567d96bfe6c285f807aa260fa6a7
09a9d0ac201018bb7db76dc4fd5ced1d4663720578e4a3f3cae696986e99eed8
96bd3d38a61c5081604a5c132be41f19bf6de5ec9d93ff32213047320d5829d0d325ade6e7f795c89175cb135653492bc3eacd3f302dbd51b139ca681d37724d
Malware Config
Extracted
| Family | redline |
| Botnet | udptest |
| C2 |
193.56.146.64:65441 |
Targets
Target
MD5
Filesize
09a9d0ac201018bb7db76dc4fd5ced1d4663720578e4a3f3cae696986e99eed8
010d09ac20e9c512b1d3e0a4cdc4ecd7
405KB
Score
10/10
SHA1
SHA256
SHA512
c3c0a152c2e1567d96bfe6c285f807aa260fa6a7
09a9d0ac201018bb7db76dc4fd5ced1d4663720578e4a3f3cae696986e99eed8
96bd3d38a61c5081604a5c132be41f19bf6de5ec9d93ff32213047320d5829d0d325ade6e7f795c89175cb135653492bc3eacd3f302dbd51b139ca681d37724d
Tags
Signatures
-
RedLine
-
RedLine Payload
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks