redline | ecc523f15457a98bd8f344f5367fd5cd56099175d10ae145d980f0e728045e6c | Triage

Sharing

General

Target

ecc523f15457a98bd8f344f5367fd5cd56099175d10ae145d980f0e728045e6c
Size

346KB
Sample

221115-rbp6kaaa6x
MD5

12a2a09116d2bfcde11b3c6de84f5750
SHA1

d64783cdb6ab7d0df3b6eb316a8189d46d4be5f4
SHA256

ecc523f15457a98bd8f344f5367fd5cd56099175d10ae145d980f0e728045e6c
SHA512

2050a1574a74667461e565859183ab0cbba8a871a679913120700b292eb40e2d41165665c24e57edb07c811a63cca7f331b4e53333956122c9537c7334248487
SSDEEP

6144:mZE5TBQg5JSyKCHKpuic+bl8K3szjCYW8n+JUWdPiE8Mv6pxN:mZUTBQgfStYKjl8zAPi7

Score

10^/10

redline neruz discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

neruz

C2

193.106.191.27:47242

Attributes

auth_value
0169a8759f3c9be473f782b96a6ff704

Targets

- Target
  
  ecc523f15457a98bd8f344f5367fd5cd56099175d10ae145d980f0e728045e6c
- Size
  
  346KB
- MD5
  
  12a2a09116d2bfcde11b3c6de84f5750
- SHA1
  
  d64783cdb6ab7d0df3b6eb316a8189d46d4be5f4
- SHA256
  
  ecc523f15457a98bd8f344f5367fd5cd56099175d10ae145d980f0e728045e6c
- SHA512
  
  2050a1574a74667461e565859183ab0cbba8a871a679913120700b292eb40e2d41165665c24e57edb07c811a63cca7f331b4e53333956122c9537c7334248487
- SSDEEP
  
  6144:mZE5TBQg5JSyKCHKpuic+bl8K3szjCYW8n+JUWdPiE8Mv6pxN:mZUTBQgfStYKjl8zAPi7
Score

10^/10

redline neruz discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineneruzdiscoveryinfostealerspywarestealer