redline | e1f737c8d5fa6fb6ecf7c55d2288afa480aacbf8571aec5f29c94b9a3756fa42 | Triage

Sharing

General

Target

e1f737c8d5fa6fb6ecf7c55d2288afa480aacbf8571aec5f29c94b9a3756fa42
Size

451KB
Sample

220211-w5n8ksefbr
MD5

06e55eb12ba50dcf03000b35240f23e0
SHA1

36992a87f6523008dce078546bf7d0f45f77b581
SHA256

e1f737c8d5fa6fb6ecf7c55d2288afa480aacbf8571aec5f29c94b9a3756fa42
SHA512

167c182484a3602962988bf36a3c594e7a472001d2b6b16c582942b58eebb9229d58e5df574111c3ff064d3cb310c2da03f50820f61eb1b739edf683dc37ab3a

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  e1f737c8d5fa6fb6ecf7c55d2288afa480aacbf8571aec5f29c94b9a3756fa42
- Size
  
  451KB
- MD5
  
  06e55eb12ba50dcf03000b35240f23e0
- SHA1
  
  36992a87f6523008dce078546bf7d0f45f77b581
- SHA256
  
  e1f737c8d5fa6fb6ecf7c55d2288afa480aacbf8571aec5f29c94b9a3756fa42
- SHA512
  
  167c182484a3602962988bf36a3c594e7a472001d2b6b16c582942b58eebb9229d58e5df574111c3ff064d3cb310c2da03f50820f61eb1b739edf683dc37ab3a
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer