redline | 4f5cdabe617dedc42294035ac5d52aa211990afe2138e63017e231a3085200c9 | Triage

Sharing

General

Target

4f5cdabe617dedc42294035ac5d52aa211990afe2138e63017e231a3085200c9
Size

277KB
Sample

221206-hydavadh94
MD5

b7be19d2b4b1d9a81e4615365dd04bf8
SHA1

d7f0fa27772bd14ecd5238609c1d16e7c2459baa
SHA256

4f5cdabe617dedc42294035ac5d52aa211990afe2138e63017e231a3085200c9
SHA512

612a3ec260ce0b8446caa0a55d06ace6cdd5df2ac3af365e34551cfa324aedc1af11440c5d3643a813fcae171bad4e883bda222318b5af10040b474cdf47eec2
SSDEEP

3072:BLjOZ5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTWi+YIxO:BLSZ5jAIDHE98JEbCe3QwSAZTj

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

C2

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Targets

- Target
  
  4f5cdabe617dedc42294035ac5d52aa211990afe2138e63017e231a3085200c9
- Size
  
  277KB
- MD5
  
  b7be19d2b4b1d9a81e4615365dd04bf8
- SHA1
  
  d7f0fa27772bd14ecd5238609c1d16e7c2459baa
- SHA256
  
  4f5cdabe617dedc42294035ac5d52aa211990afe2138e63017e231a3085200c9
- SHA512
  
  612a3ec260ce0b8446caa0a55d06ace6cdd5df2ac3af365e34551cfa324aedc1af11440c5d3643a813fcae171bad4e883bda222318b5af10040b474cdf47eec2
- SSDEEP
  
  3072:BLjOZ5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTWi+YIxO:BLSZ5jAIDHE98JEbCe3QwSAZTj
Score

10^/10

redline @2023@infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redline@2023@infostealer