redline | 5661b2c254a04df9cc1ccc3a1d332bbc8729270e450464890c7fb1cb39ad75fc | Triage

Sharing

General

Target

Offscum.exe
Size

434KB
Sample

220517-s9xhzaghhq
MD5

bfd4752d271eb314544cb3c7c1948c83
SHA1

ca6a1141ac0710c7cd6b7dec05458d2ffa36ba96
SHA256

5661b2c254a04df9cc1ccc3a1d332bbc8729270e450464890c7fb1cb39ad75fc
SHA512

c0d66345119fc1f39660790194a7cca401a337979361dcac9ad3ad3c61b75b918e8fb824ea6d73ad0ffb63eb782899e25f9cff2feb27c15473c35a292914a0df

Score

10^/10

redline test1 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

test1

C2

185.215.113.75:80

Attributes

auth_value
7ab4a4e2eae9eb7ae10f64f68df53bb3

Targets

- Target
  
  Offscum.exe
- Size
  
  434KB
- MD5
  
  bfd4752d271eb314544cb3c7c1948c83
- SHA1
  
  ca6a1141ac0710c7cd6b7dec05458d2ffa36ba96
- SHA256
  
  5661b2c254a04df9cc1ccc3a1d332bbc8729270e450464890c7fb1cb39ad75fc
- SHA512
  
  c0d66345119fc1f39660790194a7cca401a337979361dcac9ad3ad3c61b75b918e8fb824ea6d73ad0ffb63eb782899e25f9cff2feb27c15473c35a292914a0df
Score

10^/10

redline test1 discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinetest1discoveryinfostealerspywarestealer

behavioral2

discoveryspywarestealer