redline | dae8a956f37f2e85fdab4204d7c8fcfc262ef9b88806a960202c2bbd720b8932 | Triage

Sharing

General

Target

dae8a956f37f2e85fdab4204d7c8fcfc262ef9b88806a960202c2bbd720b8932
Size

1.7MB
Sample

221010-jbe2labac9
MD5

70a5995aa752ada8d7a2c721f6dd8ddc
SHA1

3d97999bc3ecaf3e7f2132c0fa597f3ad9ba3137
SHA256

dae8a956f37f2e85fdab4204d7c8fcfc262ef9b88806a960202c2bbd720b8932
SHA512

a59a469b0df5e95545e8a9171ea29f898a1eba44dc2157eb78fe4bc90e51ffb418c87d44c7c8e6d534131f0e6c761d71740e4d0a8d3b364d8dfed48e3e0185c9
SSDEEP

49152:D+/dER5Wh4hsyd32Qu9+1IQcDYl2GjzaU:D+yZ3dl1ICl2IG

Score

10^/10

redline lyla.22.09 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Lyla.22.09

C2

185.215.113.216:21921

Attributes

auth_value
2f19888cb6bad7fdc46df91dc06aacc5

Targets

- Target
  
  dae8a956f37f2e85fdab4204d7c8fcfc262ef9b88806a960202c2bbd720b8932
- Size
  
  1.7MB
- MD5
  
  70a5995aa752ada8d7a2c721f6dd8ddc
- SHA1
  
  3d97999bc3ecaf3e7f2132c0fa597f3ad9ba3137
- SHA256
  
  dae8a956f37f2e85fdab4204d7c8fcfc262ef9b88806a960202c2bbd720b8932
- SHA512
  
  a59a469b0df5e95545e8a9171ea29f898a1eba44dc2157eb78fe4bc90e51ffb418c87d44c7c8e6d534131f0e6c761d71740e4d0a8d3b364d8dfed48e3e0185c9
- SSDEEP
  
  49152:D+/dER5Wh4hsyd32Qu9+1IQcDYl2GjzaU:D+yZ3dl1ICl2IG
Score

10^/10

redline lyla.22.09 discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinelyla.22.09discoveryinfostealerspywarestealer