redline

General

Target
df1bc35ddbe6a93b602569a2b026ceeaff6c5f92576a8.exe
Size 443KB
Sample220126-p88m3adaaq
SHA256 df1bc35ddbe6a93b602569a2b026ceeaff6c5f92576a855b1b09ef9078d9768b
MD5 e55a2a5faa19f2d30c3d649cea111923
SHA1 5c02c56a763cf7e6a035861cf149840b94c64e60
SHA512 919936acd11afc2ceaa79c405ce28b9d59a3b152b6c8cbdd534ef852fde75e4a6c14aade09dd79ccd5b3f6fb3f094ac2fdad200e25595e87b489a6baac7d308d
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

sewpalpadin

C2

185.215.113.29:20819

Targets

- Target
  df1bc35ddbe6a93b602569a2b026ceeaff6c5f92576a8.exe
- Size 443KB
- SHA256 df1bc35ddbe6a93b602569a2b026ceeaff6c5f92576a855b1b09ef9078d9768b
- MD5 e55a2a5faa19f2d30c3d649cea111923
- SHA1 5c02c56a763cf7e6a035861cf149840b94c64e60
- SHA512 919936acd11afc2ceaa79c405ce28b9d59a3b152b6c8cbdd534ef852fde75e4a6c14aade09dd79ccd5b3f6fb3f094ac2fdad200e25595e87b489a6baac7d308d
- MD5 SHA1 SHA512
Score

10^/10

redline sewpalpadin discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine Payload

Reads user/profile data of web browsers

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2