redline | 16ccbb0d0f4e2c4ea94f282f38e84ef2fefd4115607f0445a0b0f72a8f607989 | Triage

Sharing

General

Target

16ccbb0d0f4e2c4ea94f282f38e84ef2fefd4115607f0445a0b0f72a8f607989
Size

440KB
Sample

220213-ppjjtshgg8
MD5

3ca4082c1caf79ec63f6dad29fef9023
SHA1

4b219e86c9c4aec04b4b254848e93446e7576f09
SHA256

16ccbb0d0f4e2c4ea94f282f38e84ef2fefd4115607f0445a0b0f72a8f607989
SHA512

a64e7df6a0e0ea8464c93d48b08cdff472ddab5dd1a43314f4f1b5cdbe76271a450ff35278d2e15dd927e9ea3d3e3424218e45f455c03bdc5244891299fb0924

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  16ccbb0d0f4e2c4ea94f282f38e84ef2fefd4115607f0445a0b0f72a8f607989
- Size
  
  440KB
- MD5
  
  3ca4082c1caf79ec63f6dad29fef9023
- SHA1
  
  4b219e86c9c4aec04b4b254848e93446e7576f09
- SHA256
  
  16ccbb0d0f4e2c4ea94f282f38e84ef2fefd4115607f0445a0b0f72a8f607989
- SHA512
  
  a64e7df6a0e0ea8464c93d48b08cdff472ddab5dd1a43314f4f1b5cdbe76271a450ff35278d2e15dd927e9ea3d3e3424218e45f455c03bdc5244891299fb0924
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer