redline | 0f8e003e3d5d98149ea799a96deb1f9f25fd42281d496f56d17fa4a78990b3d1 | Triage

Sharing

General

Target

0f8e003e3d5d98149ea799a96deb1f9f25fd42281d496f56d17fa4a78990b3d1
Size

385KB
Sample

220212-dye28afdf6
MD5

9b42dc17a349bd83eb255c3f278d8838
SHA1

8c417d2c4912a4fcddf763ff01256cd58590db9a
SHA256

0f8e003e3d5d98149ea799a96deb1f9f25fd42281d496f56d17fa4a78990b3d1
SHA512

c35214f1d14eb3bc112eb803470ac0e7926de00791a37cce8ec6b9cdbe18008709fa98fbce3218dc74159c0769fa3a40475a3191d0e4644b94ea7d0f3a3894f8

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  0f8e003e3d5d98149ea799a96deb1f9f25fd42281d496f56d17fa4a78990b3d1
- Size
  
  385KB
- MD5
  
  9b42dc17a349bd83eb255c3f278d8838
- SHA1
  
  8c417d2c4912a4fcddf763ff01256cd58590db9a
- SHA256
  
  0f8e003e3d5d98149ea799a96deb1f9f25fd42281d496f56d17fa4a78990b3d1
- SHA512
  
  c35214f1d14eb3bc112eb803470ac0e7926de00791a37cce8ec6b9cdbe18008709fa98fbce3218dc74159c0769fa3a40475a3191d0e4644b94ea7d0f3a3894f8
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer