redline | 46a2d43772995ed2cdb6ab834e9fe14ed6011b2bad904203d61b0f1af25c1f2b | Triage

Sharing

General

Target

46a2d43772995ed2cdb6ab834e9fe14ed6011b2bad904203d61b0f1af25c1f2b
Size

277KB
Sample

221206-k1d19sfe9w
MD5

35be18acaf8431872ea2d376d87f136e
SHA1

90a57a41395e0bcdab44febb91c3f51b63a04071
SHA256

46a2d43772995ed2cdb6ab834e9fe14ed6011b2bad904203d61b0f1af25c1f2b
SHA512

25a08fc7787a1cfebe4471a10e6fc7e8fd21df4187b03a1ae501eef8792e6bbb34fb9a158634e814fd7b74f412253403faed6ebb2b0a4bc42351dc90a6649085
SSDEEP

3072:pLjOj5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTWt+9xO:pLSj5jAIDHE98JEbCe3QwSAZTG

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

C2

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Targets

- Target
  
  46a2d43772995ed2cdb6ab834e9fe14ed6011b2bad904203d61b0f1af25c1f2b
- Size
  
  277KB
- MD5
  
  35be18acaf8431872ea2d376d87f136e
- SHA1
  
  90a57a41395e0bcdab44febb91c3f51b63a04071
- SHA256
  
  46a2d43772995ed2cdb6ab834e9fe14ed6011b2bad904203d61b0f1af25c1f2b
- SHA512
  
  25a08fc7787a1cfebe4471a10e6fc7e8fd21df4187b03a1ae501eef8792e6bbb34fb9a158634e814fd7b74f412253403faed6ebb2b0a4bc42351dc90a6649085
- SSDEEP
  
  3072:pLjOj5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTWt+9xO:pLSj5jAIDHE98JEbCe3QwSAZTG
Score

10^/10

redline @2023@infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redline@2023@infostealer