redline | 9ad43994be27b8156dfcb82fbe8549b258985f3579adcc94d8712a3e4d1c3294

Analysis

Target

Redline_2021_stealer-main/Kurome.Builder/build.exe
Size

95KB
MD5

9c35a28aa792b1891ab7eff22a796626
SHA1

dc99121a44891d784416ddc53d7ab91de641f5f6
SHA256

51d29d896304ab866f92d504ea616f05031ff9cc22675883f50ffbaebc19e422
SHA512

3273d1ae6178fb3caa601ef15d40b2899a5d09b1cb4df376e1ecd7b303eaf9b3b7d3352c15317283d85939e91af021cb033fdd16fa0532424476ed571ff114c9

Score

10^/10

Family

redline

Botnet

test1

213.227.155.164:29166

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral7/memory/1476-130-0x0000000000040000-0x000000000005E000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

build.exe

description pid process

Token: SeDebugPrivilege 1476 build.exe

description	pid	process
Token: SeDebugPrivilege	1476	build.exe

C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Kurome.Builder\build.exe
"C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Kurome.Builder\build.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476

memory/1476-130-0x0000000000040000-0x000000000005E000-memory.dmp

Filesize
120KB

Download
memory/1476-131-0x0000000005000000-0x0000000005618000-memory.dmp

Filesize
6.1MB

Download
memory/1476-132-0x00000000049E0000-0x00000000049F2000-memory.dmp

Filesize
72KB

Download
memory/1476-133-0x0000000004A40000-0x0000000004A7C000-memory.dmp

Filesize
240KB

Download
memory/1476-134-0x0000000004CD0000-0x0000000004DDA000-memory.dmp

Filesize
1.0MB

Download