redline | 4be851a7dcafdb22f661336684bd43d2b63bab69ab6505a237683da8d422f597 | Triage

Sharing

General

Target

4be851a7dcafdb22f661336684bd43d2b63bab69ab6505a237683da8d422f597
Size

424KB
Sample

220116-jx6fnsffdl
MD5

315d786b390d1fa46aae8091b5cd8949
SHA1

4e7cae096dd6f308b3c12be3dadeea86b5ee3da9
SHA256

4be851a7dcafdb22f661336684bd43d2b63bab69ab6505a237683da8d422f597
SHA512

9e7a01aef017112f944b08b045dbc65ca21e83041a8f922435b971372f6087435dd9348afa8909029cb845a49c0431e40aefe2c6e03061e905d1386cbe1d04ef

Score

10^/10

redline noname discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Targets

- Target
  
  4be851a7dcafdb22f661336684bd43d2b63bab69ab6505a237683da8d422f597
- Size
  
  424KB
- MD5
  
  315d786b390d1fa46aae8091b5cd8949
- SHA1
  
  4e7cae096dd6f308b3c12be3dadeea86b5ee3da9
- SHA256
  
  4be851a7dcafdb22f661336684bd43d2b63bab69ab6505a237683da8d422f597
- SHA512
  
  9e7a01aef017112f944b08b045dbc65ca21e83041a8f922435b971372f6087435dd9348afa8909029cb845a49c0431e40aefe2c6e03061e905d1386cbe1d04ef
Score

10^/10

redline noname discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinenonamediscoveryinfostealerspywarestealer