redline | da9c1b1ead104b546de4b49463c35e2f846a00c326c7bb307bc7515c593025a7 | Triage

Sharing

General

Target

tmp
Size

367KB
Sample

220812-pwdxxsfeg7
MD5

aa979a2bca63f039582ed76b0c7e5133
SHA1

5445e4449f1d6e343dab38149cbc7453ae243782
SHA256

da9c1b1ead104b546de4b49463c35e2f846a00c326c7bb307bc7515c593025a7
SHA512

93266cfff68bd6f513937e0336a6e93630409ef2fcd7343e6c506aee44139f2f344023244e55a0cda02d78d7ae92f6c108b03f91c508af7619f3c5ef6104979b

Score

10^/10

redline ruzki discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

ruzki

C2

193.106.191.165:39482

Attributes

auth_value
71a0558c0eea274a5bd617ea85786884

Targets

- Target
  
  tmp
- Size
  
  367KB
- MD5
  
  aa979a2bca63f039582ed76b0c7e5133
- SHA1
  
  5445e4449f1d6e343dab38149cbc7453ae243782
- SHA256
  
  da9c1b1ead104b546de4b49463c35e2f846a00c326c7bb307bc7515c593025a7
- SHA512
  
  93266cfff68bd6f513937e0336a6e93630409ef2fcd7343e6c506aee44139f2f344023244e55a0cda02d78d7ae92f6c108b03f91c508af7619f3c5ef6104979b
Score

10^/10

redline ruzki discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineruzkidiscoveryinfostealerspywarestealer

behavioral2

discoveryspywarestealer