redline | 8b9a7ed495ca501b7e58496fc7c111d2d95d4e0a8a2061ea536d54622179c92f | Triage

Sharing

General

Target

8b9a7ed495ca501b7e58496fc7c111d2d95d4e0a8a2061ea536d54622179c92f
Size

443KB
Sample

220817-gw38tabecl
MD5

8cd3957c7d03f5df99476236cb9e69c7
SHA1

b6e43736323ffebfc2f2cbf98ab66f36b9dbf1fe
SHA256

8b9a7ed495ca501b7e58496fc7c111d2d95d4e0a8a2061ea536d54622179c92f
SHA512

ce589fef3f6dce7bf14ea5da83e3c7704411e2dbdb704f2e015fe3abea8d39cba8527f746c11980bac4e1174109b81caa260ae315d7f012957b52b16b0095f45
SSDEEP

1536:BzX3ZhygCEicBjzkpMAREbJFvgSswAcDB0oeUKu1KjRZBfqHiAa:jhpZFBjzcMAREbJFvgSswAcDleUK2ta

Score

10^/10

redline lyla.04.08 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Lyla.04.08

C2

185.215.113.216:21921

Attributes

auth_value
7f2bf6f810414d0f2fc0b3b8d54a76ac

Targets

- Target
  
  8b9a7ed495ca501b7e58496fc7c111d2d95d4e0a8a2061ea536d54622179c92f
- Size
  
  443KB
- MD5
  
  8cd3957c7d03f5df99476236cb9e69c7
- SHA1
  
  b6e43736323ffebfc2f2cbf98ab66f36b9dbf1fe
- SHA256
  
  8b9a7ed495ca501b7e58496fc7c111d2d95d4e0a8a2061ea536d54622179c92f
- SHA512
  
  ce589fef3f6dce7bf14ea5da83e3c7704411e2dbdb704f2e015fe3abea8d39cba8527f746c11980bac4e1174109b81caa260ae315d7f012957b52b16b0095f45
- SSDEEP
  
  1536:BzX3ZhygCEicBjzkpMAREbJFvgSswAcDB0oeUKu1KjRZBfqHiAa:jhpZFBjzcMAREbJFvgSswAcDleUK2ta
Score

10^/10

redline lyla.04.08 discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinelyla.04.08discoveryinfostealerspywarestealer