redline | 835369a55e8e28ad5bbcd2d56ea886ab349915ff135b91577c08bd0fd6a9bc36 | Triage

Sharing

General

Target

835369a55e8e28ad5bbcd2d56ea886ab349915ff135b91577c08bd0fd6a9bc36
Size

346KB
Sample

221115-r2eshsec89
MD5

e002c3d232813baf666d0c4fbe6f045d
SHA1

ca367ce6f111f540edb81f52684e27e0f6be04e7
SHA256

835369a55e8e28ad5bbcd2d56ea886ab349915ff135b91577c08bd0fd6a9bc36
SHA512

792e491955f2b6a8baafd2508bc345a0c21f36e9a74c7f4cb9230c3d0d7b8a24b2cf013823e4e55c0d299188d177aac884df5d607877d81bfd2129d441cca703
SSDEEP

6144:xONTr35e9QBUrzEYV1tZTVneBr09NTQM/yN8COZuvWUT:xON/3/UrzV1bpeB49NTQWZW

Score

10^/10

redline neruz discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

neruz

C2

193.106.191.27:47242

Attributes

auth_value
0169a8759f3c9be473f782b96a6ff704

Targets

- Target
  
  835369a55e8e28ad5bbcd2d56ea886ab349915ff135b91577c08bd0fd6a9bc36
- Size
  
  346KB
- MD5
  
  e002c3d232813baf666d0c4fbe6f045d
- SHA1
  
  ca367ce6f111f540edb81f52684e27e0f6be04e7
- SHA256
  
  835369a55e8e28ad5bbcd2d56ea886ab349915ff135b91577c08bd0fd6a9bc36
- SHA512
  
  792e491955f2b6a8baafd2508bc345a0c21f36e9a74c7f4cb9230c3d0d7b8a24b2cf013823e4e55c0d299188d177aac884df5d607877d81bfd2129d441cca703
- SSDEEP
  
  6144:xONTr35e9QBUrzEYV1tZTVneBr09NTQM/yN8COZuvWUT:xON/3/UrzV1bpeB49NTQWZW
Score

10^/10

redline neruz discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineneruzdiscoveryinfostealerspywarestealer