redline | c0257738a8e9eead31925e9fac9d1bb62a57724d11dfd1d8a4a4ba3a1fc535b8 | Triage

Sharing

General

Target

c0257738a8e9eead31925e9fac9d1bb62a57724d11dfd1d8a4a4ba3a1fc535b8
Size

277KB
Sample

221206-lxjysaae71
MD5

8ccc32cd5a4010a45ebc2d6b94da56ba
SHA1

15692ffb626892fb0bb9f328ef1779ea45401017
SHA256

c0257738a8e9eead31925e9fac9d1bb62a57724d11dfd1d8a4a4ba3a1fc535b8
SHA512

7c202d52a178e5b3e2ad5f3b0cbec0a7c68ae8e8beeac2b33dc7684bc2d2661c80369b13ec8552c9e48a51f182dacfb8fdda29930fb6b2f685b2d5db3e6db99d
SSDEEP

3072:0LjOr5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTWh+2xO:0LSr5jAIDHE98JEbCe3QwSAZTJ

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

C2

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Targets

- Target
  
  c0257738a8e9eead31925e9fac9d1bb62a57724d11dfd1d8a4a4ba3a1fc535b8
- Size
  
  277KB
- MD5
  
  8ccc32cd5a4010a45ebc2d6b94da56ba
- SHA1
  
  15692ffb626892fb0bb9f328ef1779ea45401017
- SHA256
  
  c0257738a8e9eead31925e9fac9d1bb62a57724d11dfd1d8a4a4ba3a1fc535b8
- SHA512
  
  7c202d52a178e5b3e2ad5f3b0cbec0a7c68ae8e8beeac2b33dc7684bc2d2661c80369b13ec8552c9e48a51f182dacfb8fdda29930fb6b2f685b2d5db3e6db99d
- SSDEEP
  
  3072:0LjOr5jAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGC5gTWh+2xO:0LSr5jAIDHE98JEbCe3QwSAZTJ
Score

10^/10

redline @2023@infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redline@2023@infostealer