redline | f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d | Triage

Sharing

General

Target

f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d
Size

277KB
Sample

221206-jw54hscb21
MD5

eaaf6526f8907fe5aaaa2f5d8274422e
SHA1

84bfbc9a8f30999f907d9f5edd636ac66e3f384b
SHA256

f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d
SHA512

fad1c0898fa326a394f8d5d97096e6b1a11bed0efb8ca82a804d2bf18b58418f586c0e79e095497fc9bc7eb5e24812108142fd73015331995a9093f35209b8de
SSDEEP

3072:rLjO95jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTW2+TxO:rLS95jAIDHE98JEbCe3QwSAZTj

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

C2

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Targets

- Target
  
  f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d
- Size
  
  277KB
- MD5
  
  eaaf6526f8907fe5aaaa2f5d8274422e
- SHA1
  
  84bfbc9a8f30999f907d9f5edd636ac66e3f384b
- SHA256
  
  f83528450d2b2bb3928544fa48583a76e93e09bf384a0d58e8e4990a1405b43d
- SHA512
  
  fad1c0898fa326a394f8d5d97096e6b1a11bed0efb8ca82a804d2bf18b58418f586c0e79e095497fc9bc7eb5e24812108142fd73015331995a9093f35209b8de
- SSDEEP
  
  3072:rLjO95jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTW2+TxO:rLS95jAIDHE98JEbCe3QwSAZTj
Score

10^/10

redline @2023@infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redline@2023@infostealer