redline | d5f744816ed9acaea354647ebb60e2d553d80e0bb5821e09df3356c5f59d5c91 | Triage

Sharing

General

Target

d5f744816ed9acaea354647ebb60e2d553d80e0bb5821e09df3356c5f59d5c91
Size

440KB
Sample

220213-mv7shaback
MD5

426dc02df06fe6f6f2edb23aada9ffa3
SHA1

a6f056e7c03d58ccc82eca082f4ccd70e1100b75
SHA256

d5f744816ed9acaea354647ebb60e2d553d80e0bb5821e09df3356c5f59d5c91
SHA512

b104fae55de72d1382371c5c98872efd7f756352ae7375bd2f40275d3f0faae9d0c80f0b696a98a7ba177fd0977841961b4fcb925947780f2abc8b550d4758cf

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  d5f744816ed9acaea354647ebb60e2d553d80e0bb5821e09df3356c5f59d5c91
- Size
  
  440KB
- MD5
  
  426dc02df06fe6f6f2edb23aada9ffa3
- SHA1
  
  a6f056e7c03d58ccc82eca082f4ccd70e1100b75
- SHA256
  
  d5f744816ed9acaea354647ebb60e2d553d80e0bb5821e09df3356c5f59d5c91
- SHA512
  
  b104fae55de72d1382371c5c98872efd7f756352ae7375bd2f40275d3f0faae9d0c80f0b696a98a7ba177fd0977841961b4fcb925947780f2abc8b550d4758cf
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer