redline | c1df13755746263aedc11548180b52df82d48f7903760c772ec028f256cc8b5e | Triage

Sharing

General

Target

ssd.png
Size

189KB
Sample

221108-t338lsfhh3
MD5

74924eb004372ba62befb92a73572b4d
SHA1

2505266d088cfdfff862f2a4c219151e14769590
SHA256

c1df13755746263aedc11548180b52df82d48f7903760c772ec028f256cc8b5e
SHA512

ef1056774907f9c175ca3c4710f0f9f43da52ba9b882ba80c4229fd99783414fdf030f12980eda69e2b16df60e0e0fae0bb34fbf9a7837ba0a15a31e31c091a6
SSDEEP

1536:ceVNQRmjHTF82+ZQNLuNo2hcy9q0t4E1ouZZ/BDJ4aggHDQjlNeMdsoYyplbTmYJ:cRRIqWuDJ4aggUhVhxbiBKqdA/kjlYJd

Score

10^/10

redline $infostealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://62.204.41.235/red.png

Extracted

Family

redline

Botnet

$

C2

62.204.41.34:1188

Attributes

auth_value
bbb8c6d9124694fed57447b1568ddeec

Targets

- Target
  
  ssd.png
- Size
  
  189KB
- MD5
  
  74924eb004372ba62befb92a73572b4d
- SHA1
  
  2505266d088cfdfff862f2a4c219151e14769590
- SHA256
  
  c1df13755746263aedc11548180b52df82d48f7903760c772ec028f256cc8b5e
- SHA512
  
  ef1056774907f9c175ca3c4710f0f9f43da52ba9b882ba80c4229fd99783414fdf030f12980eda69e2b16df60e0e0fae0bb34fbf9a7837ba0a15a31e31c091a6
- SSDEEP
  
  1536:ceVNQRmjHTF82+ZQNLuNo2hcy9q0t4E1ouZZ/BDJ4aggHDQjlNeMdsoYyplbTmYJ:cRRIqWuDJ4aggUhVhxbiBKqdA/kjlYJd
Score

10^/10

redline $infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Blocklisted process makes network request
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

redline$infostealer