redline | 9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df | Triage

Sharing

General

Target

9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df
Size

440KB
Sample

220213-qlg29scccq
MD5

985200f2a157f985b944fe4932bce0ad
SHA1

e99e68c6aac7b75048f5bb01f0cb5cf44ed68d1a
SHA256

9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df
SHA512

9ca896d66c755e030d87aaaff6f9e0c3e315676345039c3fb5e8526cc241d79d0f0f5ac16292aefc80b2026f42b7af3b45946ece4ce8c3c19f978c0692c6453c

Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

C2

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Targets

- Target
  
  9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df
- Size
  
  440KB
- MD5
  
  985200f2a157f985b944fe4932bce0ad
- SHA1
  
  e99e68c6aac7b75048f5bb01f0cb5cf44ed68d1a
- SHA256
  
  9d31328e1cdeab2bb3f40bcf90829826518cad80cdca522018267bf0583778df
- SHA512
  
  9ca896d66c755e030d87aaaff6f9e0c3e315676345039c3fb5e8526cc241d79d0f0f5ac16292aefc80b2026f42b7af3b45946ece4ce8c3c19f978c0692c6453c
Score

10^/10

redline ruzkikakoyto discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkikakoytodiscoveryinfostealerspywarestealer