redline | c1f0e4d2b4fa1bd624feac03130f2ccacbecd4dbb37b10dc9f4b24906788d469 | Triage

Sharing

General

Target

c1f0e4d2b4fa1bd624feac03130f2ccacbecd4dbb37b10dc9f4b24906788d469
Size

469KB
Sample

220213-kr7xzsgaf6
MD5

b64f18258c20c575e1b0825072a483a9
SHA1

0b3c8b98936f84742bc96fee429c7580fa378020
SHA256

c1f0e4d2b4fa1bd624feac03130f2ccacbecd4dbb37b10dc9f4b24906788d469
SHA512

b493d6c09348c3bee07cb7fca16351f918b45bfbd319dc8fcfd334e9076d43c45d975e3ecc4466ffeeb702bde621b7b4fb4b0f25eaf532def9b2315d3c193fd7

Score

10^/10

redline noname discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:20819

Attributes

auth_value
ee92d883673b7156fdd66cac5fc8d2d0

Targets

- Target
  
  c1f0e4d2b4fa1bd624feac03130f2ccacbecd4dbb37b10dc9f4b24906788d469
- Size
  
  469KB
- MD5
  
  b64f18258c20c575e1b0825072a483a9
- SHA1
  
  0b3c8b98936f84742bc96fee429c7580fa378020
- SHA256
  
  c1f0e4d2b4fa1bd624feac03130f2ccacbecd4dbb37b10dc9f4b24906788d469
- SHA512
  
  b493d6c09348c3bee07cb7fca16351f918b45bfbd319dc8fcfd334e9076d43c45d975e3ecc4466ffeeb702bde621b7b4fb4b0f25eaf532def9b2315d3c193fd7
Score

10^/10

redline noname discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinenonamediscoveryinfostealerspywarestealer