redline | ede5c9de28eb8b51fc8eb7deb2a52716b9a2dfa33523e53b16e0329493d522fc | Triage

Sharing

General

Target

ede5c9de28eb8b51fc8eb7deb2a52716b9a2dfa33523e53b16e0329493d522fc
Size

440KB
Sample

220213-nlcrfahcg8
MD5

b2bad2c505ca8e1fbd77eb3b65b24f7a
SHA1

caf65be40f7abbee01c288a22ff892fa8bb0c9ba
SHA256

ede5c9de28eb8b51fc8eb7deb2a52716b9a2dfa33523e53b16e0329493d522fc
SHA512

4a822385438d2fc04ea8709c2ca569f72b3db66013723a551b3e5ee5a757c638e8e8fdaf50d13c166d6c80594640dac0db4c7e2c35703fc39c8d8cc9ad0f5727

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  ede5c9de28eb8b51fc8eb7deb2a52716b9a2dfa33523e53b16e0329493d522fc
- Size
  
  440KB
- MD5
  
  b2bad2c505ca8e1fbd77eb3b65b24f7a
- SHA1
  
  caf65be40f7abbee01c288a22ff892fa8bb0c9ba
- SHA256
  
  ede5c9de28eb8b51fc8eb7deb2a52716b9a2dfa33523e53b16e0329493d522fc
- SHA512
  
  4a822385438d2fc04ea8709c2ca569f72b3db66013723a551b3e5ee5a757c638e8e8fdaf50d13c166d6c80594640dac0db4c7e2c35703fc39c8d8cc9ad0f5727
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer