redline | 9b653e748a22432844e394de85160506d7db88e1720e208bd0d88e74de75cdd7 | Triage

Sharing

General

Target

9b653e748a22432844e394de85160506d7db88e1720e208bd0d88e74de75cdd7
Size

269KB
Sample

221206-p8slvaaf56
MD5

d32f78f39a357081e11c58fcf9a00c20
SHA1

f262cbcced53968050b072a617d28e3610e2502a
SHA256

9b653e748a22432844e394de85160506d7db88e1720e208bd0d88e74de75cdd7
SHA512

4bc88a153c79ca4c6a83412a176b8319a8272e5f466dde72a715619076879b78a165de8c651228da7f08d818037db015e7d0a0b0540d352442fbb0395628b1ad
SSDEEP

3072:VMADZuRENYoKjAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGCVy9Mn4jOrxO:KADZuRENSjAIDHE98JEbCe3QwSAZTf

Score

10^/10

redline @2023@infostealer

Malware Config

Extracted

Family

redline

Botnet

@2023@

C2

193.106.191.138:32796

Attributes

auth_value
ca057e5baadfd0774a34a6a949cd5e69

Targets

- Target
  
  9b653e748a22432844e394de85160506d7db88e1720e208bd0d88e74de75cdd7
- Size
  
  269KB
- MD5
  
  d32f78f39a357081e11c58fcf9a00c20
- SHA1
  
  f262cbcced53968050b072a617d28e3610e2502a
- SHA256
  
  9b653e748a22432844e394de85160506d7db88e1720e208bd0d88e74de75cdd7
- SHA512
  
  4bc88a153c79ca4c6a83412a176b8319a8272e5f466dde72a715619076879b78a165de8c651228da7f08d818037db015e7d0a0b0540d352442fbb0395628b1ad
- SSDEEP
  
  3072:VMADZuRENYoKjAID8M/tdy98JMLOSEkb7WLa3QA/SfSnZKGCVy9Mn4jOrxO:KADZuRENSjAIDHE98JEbCe3QwSAZTf
Score

10^/10

redline @2023@infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redline@2023@infostealer