redline | 4bdc48e114978c475a2497736efb4fa1afd76839ab21e19e3138ee47af7106f3 | Triage

Sharing

General

Target

46ec617afcb7031e6e8dc755fc0debcf
Size

400KB
Sample

220516-qwsxhsfddq
MD5

46ec617afcb7031e6e8dc755fc0debcf
SHA1

9d66505a147ab4bb9a5382856cea201f75190c50
SHA256

4bdc48e114978c475a2497736efb4fa1afd76839ab21e19e3138ee47af7106f3
SHA512

37991284d800faa1d0601ce6fdc08d336fffeec73aa1da213b2923806223b75aef0a63667e17cf9b04412c2eed27f5f94172deb0952228b46177c3331b9b4dac

Score

10^/10

redline test1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

test1

C2

185.215.113.75:80

Attributes

auth_value
7ab4a4e2eae9eb7ae10f64f68df53bb3

Targets

- Target
  
  46ec617afcb7031e6e8dc755fc0debcf
- Size
  
  400KB
- MD5
  
  46ec617afcb7031e6e8dc755fc0debcf
- SHA1
  
  9d66505a147ab4bb9a5382856cea201f75190c50
- SHA256
  
  4bdc48e114978c475a2497736efb4fa1afd76839ab21e19e3138ee47af7106f3
- SHA512
  
  37991284d800faa1d0601ce6fdc08d336fffeec73aa1da213b2923806223b75aef0a63667e17cf9b04412c2eed27f5f94172deb0952228b46177c3331b9b4dac
Score

10^/10

redline test1 discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinetest1discoveryinfostealerspywarestealer

behavioral2

discoveryspywarestealer