redline

General

Target
169f98d75d6afa0229fb4d556b73e46a
Size 292KB
Sample211219-a88kqsffh7
SHA256 f7a6f3e70fbbdac903eb05428b9f48179fd41a2aa6a04f6915697d9f6582a1de
MD5 169f98d75d6afa0229fb4d556b73e46a
SHA1 844ed1d0a800580d63a4ae8db0e580b0965a2608
SHA512 3fa63caaf4903da02379c57c00f86675807382161e0f6c5a56dab5ea0a4ffe90e46a57765e4dc421a1b7f9707e75290849c10eae921328d9efcf684dd46e1eae
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Targets

- Target
  169f98d75d6afa0229fb4d556b73e46a
- Size 292KB
- SHA256 f7a6f3e70fbbdac903eb05428b9f48179fd41a2aa6a04f6915697d9f6582a1de
- MD5 169f98d75d6afa0229fb4d556b73e46a
- SHA1 844ed1d0a800580d63a4ae8db0e580b0965a2608
- SHA512 3fa63caaf4903da02379c57c00f86675807382161e0f6c5a56dab5ea0a4ffe90e46a57765e4dc421a1b7f9707e75290849c10eae921328d9efcf684dd46e1eae
- MD5 SHA1 SHA512
Score

10^/10

redline noname discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine Payload

Reads user/profile data of web browsers

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2