redline | b3b3828acc8dacd6f66f115329bb8c7d55a1a03e71d2c01a27713d2b39918ae1 | Triage

Sharing

General

Target

b3b3828acc8dacd6f66f115329bb8c7d55a1a03e71d2c01a27713d2b39918ae1
Size

265KB
Sample

220609-lmzlgsefap
MD5

ea51e8dea56b76b896057a3a0e7ca495
SHA1

9ec1fe80f580aa68438e61b3cbb283b44b040818
SHA256

b3b3828acc8dacd6f66f115329bb8c7d55a1a03e71d2c01a27713d2b39918ae1
SHA512

c12fee9a4659ae4256f5c24ed52fb1facc77be5e17fa31556b1dabcc093bf3792955a1fd092e7491258ec149c9cfe76dfd7e54bfa198a505b7a53bfe92c8360e

Score

10^/10

redline lyla2 privatos discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

PRIVATOS

C2

185.215.113.75:81

Attributes

auth_value
5ea9b11f430f74fc81d40ef634ac1813

Extracted

Family

redline

Botnet

Lyla2

C2

185.215.113.201:21921

Attributes

auth_value
f3b96059847b054b3939cadefd4424ee

Targets

- Target
  
  b3b3828acc8dacd6f66f115329bb8c7d55a1a03e71d2c01a27713d2b39918ae1
- Size
  
  265KB
- MD5
  
  ea51e8dea56b76b896057a3a0e7ca495
- SHA1
  
  9ec1fe80f580aa68438e61b3cbb283b44b040818
- SHA256
  
  b3b3828acc8dacd6f66f115329bb8c7d55a1a03e71d2c01a27713d2b39918ae1
- SHA512
  
  c12fee9a4659ae4256f5c24ed52fb1facc77be5e17fa31556b1dabcc093bf3792955a1fd092e7491258ec149c9cfe76dfd7e54bfa198a505b7a53bfe92c8360e
Score

10^/10

redline lyla2 privatos discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

redlinelyla2privatosdiscoveryinfostealerspywarestealer