redline | 2f1a428ef34edc20ae0fc6caf063388f47f82f039fbdbceb2193dca155d16cc3 | Triage

Sharing

General

Target

2f1a428ef34edc20ae0fc6caf063388f47f82f039fbdbceb2193dca155d16cc3
Size

175KB
Sample

221208-nyq5lahh49
MD5

886b804ad445e498eefb6cfb3f92fd51
SHA1

30a0b4b6846772cbc7046da3d3b48baf1bdc9ca2
SHA256

2f1a428ef34edc20ae0fc6caf063388f47f82f039fbdbceb2193dca155d16cc3
SHA512

459c6ca7c399920c02c081857269b52e5bac73e1a0afa830dc890f0b50875ea2d5b2bb36cd57941d66714e2f3278791cd13c98bb62ad4bc7f9b5b84ba489829d
SSDEEP

3072:nxqZW11a2kX8fRmqHkU6erRFlhrvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jO3:xqZkRb7Nlh

Score

10^/10

redline nosh discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Nosh

C2

31.41.244.186:4683

Attributes

auth_value
b8a171b8f2a42502e350c6a85f0c8271

Targets

- Target
  
  2f1a428ef34edc20ae0fc6caf063388f47f82f039fbdbceb2193dca155d16cc3
- Size
  
  175KB
- MD5
  
  886b804ad445e498eefb6cfb3f92fd51
- SHA1
  
  30a0b4b6846772cbc7046da3d3b48baf1bdc9ca2
- SHA256
  
  2f1a428ef34edc20ae0fc6caf063388f47f82f039fbdbceb2193dca155d16cc3
- SHA512
  
  459c6ca7c399920c02c081857269b52e5bac73e1a0afa830dc890f0b50875ea2d5b2bb36cd57941d66714e2f3278791cd13c98bb62ad4bc7f9b5b84ba489829d
- SSDEEP
  
  3072:nxqZW11a2kX8fRmqHkU6erRFlhrvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jO3:xqZkRb7Nlh
Score

10^/10

redline nosh discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinenoshdiscoveryinfostealerspywarestealer