redline | 5c65958b50e21bbf2bde53c496323851fd43667288d99b57165343553de77b02 | Triage

Sharing

General

Target

5c65958b50e21bbf2bde53c496323851fd43667288d99b57165343553de77b02
Size

90KB
Sample

220905-le4v8shbc7
MD5

253cb4313577e31fa2ecc94d708f8398
SHA1

bee6638ed20ce2df51b47b5fc6f47fd4c68d0039
SHA256

5c65958b50e21bbf2bde53c496323851fd43667288d99b57165343553de77b02
SHA512

ae47cef85324a8cf2af0d4cc4b65dbcce0d0eed793eb839ce1dfdf608f41e1c9d7543c8ddb62bccfc420afa1368c8c98b289eaec611b8da9ba6c07452559c315
SSDEEP

1536:dPqUPY5oyWjddJg3d3ubDd4ye2DNeDNXNDqDNaiuBjyC4DN1DvyDNPqAJ7WpFMQk:sruZehOqJibV1gTF3HI+

Score

10^/10

redline lyllkal.05.09 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Lyllkal.05.09

C2

185.215.113.216:21921

Attributes

auth_value
2df530f82cb4bd0f6bef5527a1d5de70

Targets

- Target
  
  5c65958b50e21bbf2bde53c496323851fd43667288d99b57165343553de77b02
- Size
  
  90KB
- MD5
  
  253cb4313577e31fa2ecc94d708f8398
- SHA1
  
  bee6638ed20ce2df51b47b5fc6f47fd4c68d0039
- SHA256
  
  5c65958b50e21bbf2bde53c496323851fd43667288d99b57165343553de77b02
- SHA512
  
  ae47cef85324a8cf2af0d4cc4b65dbcce0d0eed793eb839ce1dfdf608f41e1c9d7543c8ddb62bccfc420afa1368c8c98b289eaec611b8da9ba6c07452559c315
- SSDEEP
  
  1536:dPqUPY5oyWjddJg3d3ubDd4ye2DNeDNXNDqDNaiuBjyC4DN1DvyDNPqAJ7WpFMQk:sruZehOqJibV1gTF3HI+
Score

10^/10

redline lyllkal.05.09 discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

lyllkal.05.09redline

behavioral1

redlinelyllkal.05.09discoveryinfostealerspywarestealer