redline | 4663db4b0450ae09d0c1b2acc9d430eeb08f146cf92ac38ba11db29ad8e61e83 | Triage

Sharing

General

Target

4663db4b0450ae09d0c1b2acc9d430eeb08f146cf92ac38ba11db29ad8e61e83
Size

412KB
Sample

220211-mavx7sebcn
MD5

943a6281710015b584f1116d8f57d839
SHA1

7fcce409392c10cbf1b5e4f29ad282e41a086264
SHA256

4663db4b0450ae09d0c1b2acc9d430eeb08f146cf92ac38ba11db29ad8e61e83
SHA512

5275b0dcea6696fca6e7a08767edde6a8b1fe191698e40e9b4ba9d41718cb28d44009937997d160ec92f04ff113bb73421f85495e34b7d9104f087287594de54

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  4663db4b0450ae09d0c1b2acc9d430eeb08f146cf92ac38ba11db29ad8e61e83
- Size
  
  412KB
- MD5
  
  943a6281710015b584f1116d8f57d839
- SHA1
  
  7fcce409392c10cbf1b5e4f29ad282e41a086264
- SHA256
  
  4663db4b0450ae09d0c1b2acc9d430eeb08f146cf92ac38ba11db29ad8e61e83
- SHA512
  
  5275b0dcea6696fca6e7a08767edde6a8b1fe191698e40e9b4ba9d41718cb28d44009937997d160ec92f04ff113bb73421f85495e34b7d9104f087287594de54
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer