redline | 8cf21b1b10b6793c5cf45d16bda93cd71e1171559068a156bbaa68d1204cb9f3 | Triage

Sharing

General

Target

Offscum.exe
Size

400KB
Sample

220516-pgln8adfhq
MD5

ad95c6a895478d0fa99462f69a710190
SHA1

ac93857e5ed2ef6bccd3a9538359026806fcc593
SHA256

8cf21b1b10b6793c5cf45d16bda93cd71e1171559068a156bbaa68d1204cb9f3
SHA512

7d8b838d807e6ef3104bd9a995c0e609ed9718551d1a5463bc79dcf2b157819d43f48b196c73e3d48c38ecc5881628a981574f9dea2c399a0257698e78797030

Score

10^/10

redline test1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

test1

C2

185.215.113.75:80

Attributes

auth_value
7ab4a4e2eae9eb7ae10f64f68df53bb3

Targets

- Target
  
  Offscum.exe
- Size
  
  400KB
- MD5
  
  ad95c6a895478d0fa99462f69a710190
- SHA1
  
  ac93857e5ed2ef6bccd3a9538359026806fcc593
- SHA256
  
  8cf21b1b10b6793c5cf45d16bda93cd71e1171559068a156bbaa68d1204cb9f3
- SHA512
  
  7d8b838d807e6ef3104bd9a995c0e609ed9718551d1a5463bc79dcf2b157819d43f48b196c73e3d48c38ecc5881628a981574f9dea2c399a0257698e78797030
Score

10^/10

redline test1 discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinetest1discoveryinfostealerspywarestealer

behavioral2