redline | 7642d1576369c61f2914e75e5b9be8e4c3cabb3f165efa368039e0c1fd1c20f4 | Triage

Sharing

General

Target

7642d1576369c61f2914e75e5b9be8e4c3cabb3f165efa368039e0c1fd1c20f4
Size

340KB
Sample

220210-tp63caaebj
MD5

19944846f0946b23bef2cebe8ca55627
SHA1

1d8b4de21f40c4c8b5b1716b1c6c735cb1505246
SHA256

7642d1576369c61f2914e75e5b9be8e4c3cabb3f165efa368039e0c1fd1c20f4
SHA512

4d0f5e733361a8dc17532adb9adb7192303c2e8018f5b9dfd414b3d18764b61ea6103bf7c9717cbb6eb2e6cca214757d5d69896c835cc6a4ebd08f216fa729b5

Score

10^/10

redline noname discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:20819

Attributes

auth_value
ee92d883673b7156fdd66cac5fc8d2d0

Targets

- Target
  
  7642d1576369c61f2914e75e5b9be8e4c3cabb3f165efa368039e0c1fd1c20f4
- Size
  
  340KB
- MD5
  
  19944846f0946b23bef2cebe8ca55627
- SHA1
  
  1d8b4de21f40c4c8b5b1716b1c6c735cb1505246
- SHA256
  
  7642d1576369c61f2914e75e5b9be8e4c3cabb3f165efa368039e0c1fd1c20f4
- SHA512
  
  4d0f5e733361a8dc17532adb9adb7192303c2e8018f5b9dfd414b3d18764b61ea6103bf7c9717cbb6eb2e6cca214757d5d69896c835cc6a4ebd08f216fa729b5
Score

10^/10

redline noname discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinenonamediscoveryinfostealerspywarestealer