redline | 981aa51ef43d2883f2ebd810060f5f1d7cb347e411eecc52bd931a325c1a8cba | Triage

Sharing

General

Target

981aa51ef43d2883f2ebd810060f5f1d7cb347e411eecc52bd931a325c1a8cba
Size

384KB
Sample

220212-g9kcvsafdp
MD5

24b43cc06a3b788b3beea4086e725c8b
SHA1

ec4ef5a102a88b0f050b5d43eb862b3da856dd0c
SHA256

981aa51ef43d2883f2ebd810060f5f1d7cb347e411eecc52bd931a325c1a8cba
SHA512

354b4699f5c11645ddc764c051b0088add18fb2e23888cce0a9f967f6f0c3960faa0a0dc2cdb8edf30cc1d2edd2133abdec383fd35d85bf2cbb048ca7e93d194

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  981aa51ef43d2883f2ebd810060f5f1d7cb347e411eecc52bd931a325c1a8cba
- Size
  
  384KB
- MD5
  
  24b43cc06a3b788b3beea4086e725c8b
- SHA1
  
  ec4ef5a102a88b0f050b5d43eb862b3da856dd0c
- SHA256
  
  981aa51ef43d2883f2ebd810060f5f1d7cb347e411eecc52bd931a325c1a8cba
- SHA512
  
  354b4699f5c11645ddc764c051b0088add18fb2e23888cce0a9f967f6f0c3960faa0a0dc2cdb8edf30cc1d2edd2133abdec383fd35d85bf2cbb048ca7e93d194
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer