redline | c0b06e7e67bf96362b7ea5a42c83ff09e9baacb7ab39b4b1e5998991cf198bbf | Triage

Sharing

General

Target

c0b06e7e67bf96362b7ea5a42c83ff09e9baacb7ab39b4b1e5998991cf198bbf
Size

277KB
Sample

221206-kfqvbsdg5z
MD5

b2ff2731fe0792ff8469ea4a2dc7ef22
SHA1

a53f819724e79781cf0f5907cf437e1de3848259
SHA256

c0b06e7e67bf96362b7ea5a42c83ff09e9baacb7ab39b4b1e5998991cf198bbf
SHA512

9fceea9d93e2e62747da2ef100bb9601e4a9614eb8ad4e1a89ec1e33edf09d1febb62e8d0e28d68bf0ecaaeb471ccf9db190c55492614ccc721b7bba5f3f659b
SSDEEP

3072:4LjOr5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTWT+NxO:4LSr5jAIDHE98JEbCe3QwSAZTI

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

C2

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Targets

- Target
  
  c0b06e7e67bf96362b7ea5a42c83ff09e9baacb7ab39b4b1e5998991cf198bbf
- Size
  
  277KB
- MD5
  
  b2ff2731fe0792ff8469ea4a2dc7ef22
- SHA1
  
  a53f819724e79781cf0f5907cf437e1de3848259
- SHA256
  
  c0b06e7e67bf96362b7ea5a42c83ff09e9baacb7ab39b4b1e5998991cf198bbf
- SHA512
  
  9fceea9d93e2e62747da2ef100bb9601e4a9614eb8ad4e1a89ec1e33edf09d1febb62e8d0e28d68bf0ecaaeb471ccf9db190c55492614ccc721b7bba5f3f659b
- SSDEEP
  
  3072:4LjOr5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTWT+NxO:4LSr5jAIDHE98JEbCe3QwSAZTI
Score

10^/10

redline @2023@infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redline@2023@infostealer