redline | b2c1e70f30e4d975f591d4e91bc6ba75983a0febff66dcb8a046f0a20776e11b | Triage

Sharing

General

Target

b2c1e70f30e4d975f591d4e91bc6ba75983a0febff66dcb8a046f0a20776e11b
Size

3.1MB
Sample

220928-zatrcsabdj
MD5

017cf69e1b85d3ea820a41f8b86eba76
SHA1

48e0282ab8ba28b25c851a0e8bb42d7403740a9e
SHA256

b2c1e70f30e4d975f591d4e91bc6ba75983a0febff66dcb8a046f0a20776e11b
SHA512

b203a68e8e879920e36e24e076c1e9ed892b6d031bff9acc6d2390612c9b34d34fcc1442dd65c7e7ec85bf25cc31b26f08c2e800edeb1e51c6591b2ac2dce2a2
SSDEEP

12288:3iYImGPztYZPNwUPaa2qk+LFCxviVJ4bZSc:SYazmZ1wUn20xCxv6J+Z

Score

10^/10

redline lyla.22.09 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Lyla.22.09

C2

185.215.113.216:21921

Attributes

auth_value
2f19888cb6bad7fdc46df91dc06aacc5

Targets

- Target
  
  b2c1e70f30e4d975f591d4e91bc6ba75983a0febff66dcb8a046f0a20776e11b
- Size
  
  3.1MB
- MD5
  
  017cf69e1b85d3ea820a41f8b86eba76
- SHA1
  
  48e0282ab8ba28b25c851a0e8bb42d7403740a9e
- SHA256
  
  b2c1e70f30e4d975f591d4e91bc6ba75983a0febff66dcb8a046f0a20776e11b
- SHA512
  
  b203a68e8e879920e36e24e076c1e9ed892b6d031bff9acc6d2390612c9b34d34fcc1442dd65c7e7ec85bf25cc31b26f08c2e800edeb1e51c6591b2ac2dce2a2
- SSDEEP
  
  12288:3iYImGPztYZPNwUPaa2qk+LFCxviVJ4bZSc:SYazmZ1wUn20xCxv6J+Z
Score

10^/10

redline lyla.22.09 discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinelyla.22.09discoveryinfostealerspywarestealer