redline | 6d905d696672b71a96fd906da7e2d4b13d78a61752b0af0c02ec1d07fb954494 | Triage

Sharing

General

Target

6d905d696672b71a96fd906da7e2d4b13d78a61752b0af0c02ec1d07fb954494
Size

384KB
Sample

220212-xk2tlsehbm
MD5

976059601c82f50f0a255aea800d411a
SHA1

e9ef4e81bb89afb301a14b0505b0cca6b487649e
SHA256

6d905d696672b71a96fd906da7e2d4b13d78a61752b0af0c02ec1d07fb954494
SHA512

9e2a42bb7e4a9bd7ca63592798a99105fab112dcd424d77b03d441e51349359ae521e475ebd2ad5df48be662b9f4cc0bf58489ca147b86cb235b42a4821d9acf

Score

10^/10

redline noname discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:20819

Attributes

auth_value
ee92d883673b7156fdd66cac5fc8d2d0

Targets

- Target
  
  6d905d696672b71a96fd906da7e2d4b13d78a61752b0af0c02ec1d07fb954494
- Size
  
  384KB
- MD5
  
  976059601c82f50f0a255aea800d411a
- SHA1
  
  e9ef4e81bb89afb301a14b0505b0cca6b487649e
- SHA256
  
  6d905d696672b71a96fd906da7e2d4b13d78a61752b0af0c02ec1d07fb954494
- SHA512
  
  9e2a42bb7e4a9bd7ca63592798a99105fab112dcd424d77b03d441e51349359ae521e475ebd2ad5df48be662b9f4cc0bf58489ca147b86cb235b42a4821d9acf
Score

10^/10

redline noname discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinenonamediscoveryinfostealerspywarestealer