redline | d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b | Triage

Sharing

General

Target

d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b
Size

269KB
Sample

221206-mm6v8sda9x
MD5

10bf7fdbdc5812d14ea2bb8e96b89aaf
SHA1

16436b5caa6099ce764d0f834ba0ee5e0dea3d3e
SHA256

d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b
SHA512

1ac93b3e3d65363b191d829a4d8882632bd6e507ded8bd0a3227e715e6302de2c00a3cd42d40858107024f90fb19ff6ac2b8e3c5a51c3dbb2177177eeb035da6
SSDEEP

3072:6MADZu3ENYoKjAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGCVy95n45erxO:fADZu3ENSjAIDHE98JEbCe3QwSAZTu

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

C2

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Targets

- Target
  
  d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b
- Size
  
  269KB
- MD5
  
  10bf7fdbdc5812d14ea2bb8e96b89aaf
- SHA1
  
  16436b5caa6099ce764d0f834ba0ee5e0dea3d3e
- SHA256
  
  d18b070a3ff98f7eed74caf5573bfdf8615c234bc9fe216b29940b24144c1b2b
- SHA512
  
  1ac93b3e3d65363b191d829a4d8882632bd6e507ded8bd0a3227e715e6302de2c00a3cd42d40858107024f90fb19ff6ac2b8e3c5a51c3dbb2177177eeb035da6
- SSDEEP
  
  3072:6MADZu3ENYoKjAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGCVy95n45erxO:fADZu3ENSjAIDHE98JEbCe3QwSAZTu
Score

10^/10

redline @2023@infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redline@2023@infostealer