Overview

overview

10

Static

static

10

Redline_20...er.exe

windows7_x64

1

Redline_20...er.exe

windows10_x64

1

Redline_20...er.exe

windows10-2004_x64

1

Redline_20...er.exe

windows11_x64

Redline_20...ld.exe

windows7_x64

10

Redline_20...ld.exe

windows10_x64

10

Redline_20...ld.exe

windows10-2004_x64

10

Redline_20...ld.exe

windows11_x64

Redline_20...st.exe

windows7_x64

1

Redline_20...st.exe

windows10_x64

1

Redline_20...st.exe

windows10-2004_x64

1

Redline_20...st.exe

windows11_x64

Redline_20...er.exe

windows7_x64

4

Redline_20...er.exe

windows10_x64

4

Redline_20...er.exe

windows10-2004_x64

4

Redline_20...er.exe

windows11_x64

Redline_20...el.exe

windows7_x64

10

Redline_20...el.exe

windows10_x64

10

Redline_20...el.exe

windows10-2004_x64

10

Redline_20...el.exe

windows11_x64

Redline_20...me.exe

windows7_x64

8

Redline_20...me.exe

windows10_x64

8

Redline_20...me.exe

windows10-2004_x64

8

Redline_20...me.exe

windows11_x64

Redline_20...48.exe

windows7_x64

8

Redline_20...48.exe

windows10_x64

8

Redline_20...48.exe

windows10-2004_x64

8

Redline_20...48.exe

windows11_x64

Redline_20...ar.exe

windows7_x64

1

Redline_20...ar.exe

windows10_x64

1

Redline_20...ar.exe

windows10-2004_x64

1

Redline_20...ar.exe

windows11_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Redline_2021_stealer-main.rar

  • Size

    14.5MB

  • Sample

    220702-rnvxkshef3

  • MD5

    845874ac5340b1cdfb3de68baf474659

  • SHA1

    d027798890003c454d3584fe30b95fcc5f016f7d

  • SHA256

    9ad43994be27b8156dfcb82fbe8549b258985f3579adcc94d8712a3e4d1c3294

  • SHA512

    1a92ce94f87e36be42914b969c3b1edbf4d62eb9e99e4fc57b9ef38d34dc8d053f9bb0112c3b9ee589e0593ebc0cc9efcc56b9f2be1c3ed5e1910d48d64f996b

Score
10/10
redlinetest1discoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

test1

C2

213.227.155.164:29166

Targets

    • Target

      Redline_2021_stealer-main/Kurome.Builder/Kurome.Builder.exe

    • Size

      137KB

    • MD5

      cf38a4bde3fe5456dcaf2b28d3bfb709

    • SHA1

      711518af5fa13f921f3273935510627280730543

    • SHA256

      c47b78e566425fc4165a83b2661313e41ee8d66241f7bea7723304a6a751595e

    • SHA512

      3302b270ee028868ff877fa291c51e6c8b12478e7d873ddb9009bb68b55bd3a08a2756619b4415a76a5b4167abd7c7c3b9cc9f44c32a29225ff0fc2f94a1a4cc

    Score
    1/10
    behavioral1behavioral2behavioral3behavioral4

    • Target

      Redline_2021_stealer-main/Kurome.Builder/build.exe

    • Size

      95KB

    • MD5

      9c35a28aa792b1891ab7eff22a796626

    • SHA1

      dc99121a44891d784416ddc53d7ab91de641f5f6

    • SHA256

      51d29d896304ab866f92d504ea616f05031ff9cc22675883f50ffbaebc19e422

    • SHA512

      3273d1ae6178fb3caa601ef15d40b2899a5d09b1cb4df376e1ecd7b303eaf9b3b7d3352c15317283d85939e91af021cb033fdd16fa0532424476ed571ff114c9

    Score
    10/10
    redlinetest1infostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    behavioral5behavioral6behavioral7behavioral8

    • Target

      Redline_2021_stealer-main/Kurome.Host/Kurome.Host.exe

    • Size

      119KB

    • MD5

      4fde0f80c408af27a8d3ddeffea12251

    • SHA1

      e834291127af150ce287443c5ea607a7ae337484

    • SHA256

      1b644cdb1c7247c07d810c0ea10bec34dc5600f3645589690a219de08cf2dedb

    • SHA512

      3693aeaa2cc276060b899f21f6f57f435b75fec5bcd7725b2dd79043b341c12ebc29bd43b287eb22a3e31fd2b50c4fa36bf020f9f3db5e2f75fe8cc747eca5f5

    Score
    1/10
    behavioral9behavioral10behavioral11behavioral12

    • Target

      Redline_2021_stealer-main/Kurome.Loader/Kurome.Loader.exe

    • Size

      2.2MB

    • MD5

      a3ec05d5872f45528bbd05aeecf0a4ba

    • SHA1

      68486279c63457b0579d86cd44dd65279f22d36f

    • SHA256

      d4797b2e4957c9041ba32454657f5d9a457851c6b5845a57e0e5397707e7773e

    • SHA512

      b96b582bb26cb40dbb2a0709a6c88acd87242d0607d548473e3023ffa0a6c9348922a98a4948f105ea0b8224a3930af1e698c6cee3c36ca6a83df6d20c868e8e

    Score
    4/10
    behavioral13behavioral14behavioral15behavioral16

    • Target

      Redline_2021_stealer-main/Panel/RedLine_20_2/Panel/Panel.exe

    • Size

      9.3MB

    • MD5

      f4e19b67ef27af1434151a512860574e

    • SHA1

      56304fc2729974124341e697f3b21c84a8dd242a

    • SHA256

      c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a

    • SHA512

      a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77

    Score
    10/10
    redlineinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral17behavioral18behavioral19behavioral20

    • Target

      Redline_2021_stealer-main/Panel/RedLine_20_2/Tools/Chrome.exe

    • Size

      1.1MB

    • MD5

      92cfeb7c07906eac0d4220b8a1ed65b1

    • SHA1

      882b83e903b5b4c7c75f0b1dc31bb7aa8938d8fa

    • SHA256

      38b827a431b89da0d9cdd444373364371f4f6e6bf299e7935f05b2351ca9186c

    • SHA512

      e2ee932f5b81403935a977f9d3c8e2e4f6a4c9a1967b7e1cf61229a7746a24aae486ac6b779fb570f1dff02a3ff30107044f0427ce46474b91d788c78c8fcfbf

    Score
    8/10
    discoveryevasionpersistencespywarestealertrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral21behavioral22behavioral23behavioral24

    • Target

      Redline_2021_stealer-main/Panel/RedLine_20_2/Tools/NetFramework48.exe

    • Size

      1.4MB

    • MD5

      86482f2f623a52b8344b00968adc7b43

    • SHA1

      755349ecd6a478fe010e466b29911d2388f6ce94

    • SHA256

      2c7530edbf06b08a0b9f4227c24ec37d95f3998ee7e6933ae22a9943d0adfa57

    • SHA512

      64c168263fd48788d90919cbb9992855aed4ffe9a0f8052cb84f028ca239102c0571dfaf75815d72ad776009f5fc4469c957113fb66da7d4e9c83601e8287f3d

    Score
    8/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral25behavioral26behavioral27behavioral28

    • Target

      Redline_2021_stealer-main/Panel/RedLine_20_2/Tools/WinRar.exe

    • Size

      3.2MB

    • MD5

      b66dec691784f00061bc43e62030c343

    • SHA1

      779d947d41efafc2995878e56e213411de8fb4cf

    • SHA256

      26b40c79356453c60498772423f99384a3d24dd2d0662d215506768cb9c58370

    • SHA512

      6a89bd581baf372f07e76a3378e6f6eb29cac2e4981a7f0affb4101153407cadfce9f1b6b28d5a003f7d4039577029b2ec6ebcfd58e55288e056614fb03f8ba3

    Score
    1/10
    behavioral29behavioral30behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

6
T1012

System Information Discovery

8
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks

static1

test1redline
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

redlinetest1infostealer
Score
10/10

behavioral6

redlinetest1infostealer
Score
10/10

behavioral7

redlinetest1infostealer
Score
10/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
4/10

behavioral14

Score
4/10

behavioral15

Score
4/10

behavioral16

Score
1/10

behavioral17

redlineinfostealer
Score
10/10

behavioral18

redlineinfostealer
Score
10/10

behavioral19

redlineinfostealer
Score
10/10

behavioral20

Score
1/10

behavioral21

discoveryevasionpersistencespywarestealertrojan
Score
8/10

behavioral22

discoverypersistencespywarestealer
Score
8/10

behavioral23

discoverypersistencespywarestealer
Score
8/10

behavioral24

Score
1/10

behavioral25

Score
8/10

behavioral26

Score
8/10

behavioral27

Score
8/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10