redline | 62384f781539c8c4c3e607d6f99f621570a905ac2da27c53179e81dc63dd050b | Triage

Sharing

General

Target

62384f781539c8c4c3e607d6f99f621570a905ac2da27c53179e81dc63dd050b
Size

371KB
Sample

220212-3cbkcadcb8
MD5

62e6ba738e00347e420972336b69f7ba
SHA1

cb934dd2302b86bca7e381300af5429e120252be
SHA256

62384f781539c8c4c3e607d6f99f621570a905ac2da27c53179e81dc63dd050b
SHA512

ddb24b8527be9da04b48460f41e8b75639361303a9307c816620b8b6ff3a2c495d5468a09bb47510229adf457b3e9b705e0d03dce00a000eab66cca055e008b4

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  62384f781539c8c4c3e607d6f99f621570a905ac2da27c53179e81dc63dd050b
- Size
  
  371KB
- MD5
  
  62e6ba738e00347e420972336b69f7ba
- SHA1
  
  cb934dd2302b86bca7e381300af5429e120252be
- SHA256
  
  62384f781539c8c4c3e607d6f99f621570a905ac2da27c53179e81dc63dd050b
- SHA512
  
  ddb24b8527be9da04b48460f41e8b75639361303a9307c816620b8b6ff3a2c495d5468a09bb47510229adf457b3e9b705e0d03dce00a000eab66cca055e008b4
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer