redline | 082c7e98622b80965a2b5c95585b1dce36731e3fcd5c498bdbdfc1e6ccdb7ec9 | Triage

Sharing

General

Target

fart.exe
Size

378KB
Sample

220525-1ksgqadee9
MD5

231f93a111ff043d90a518194763ae81
SHA1

a74637950feca69c915f41dfe8a59828d1fa71c4
SHA256

082c7e98622b80965a2b5c95585b1dce36731e3fcd5c498bdbdfc1e6ccdb7ec9
SHA512

cefd677ec0db2236d971b586184751fe7eddc9c9660583b76a53ee2d976576971a9cec9e30671cc24d8cf7c2cafde27695d9a858ad3762878059365d1339a100

Score

10^/10

redline top discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

top

C2

185.215.113.75:81

Attributes

auth_value
ff6259bc2baf33b54b454aad484fb0ee

Targets

- Target
  
  fart.exe
- Size
  
  378KB
- MD5
  
  231f93a111ff043d90a518194763ae81
- SHA1
  
  a74637950feca69c915f41dfe8a59828d1fa71c4
- SHA256
  
  082c7e98622b80965a2b5c95585b1dce36731e3fcd5c498bdbdfc1e6ccdb7ec9
- SHA512
  
  cefd677ec0db2236d971b586184751fe7eddc9c9660583b76a53ee2d976576971a9cec9e30671cc24d8cf7c2cafde27695d9a858ad3762878059365d1339a100
Score

10^/10

redline top discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinetopdiscoveryinfostealerspywarestealer

behavioral2

discoveryspywarestealer