redline | dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165 | Triage

Sharing

General

Target

dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
Size

895KB
Sample

230324-vqn4lahh3s
MD5

3c62500496bfc4f35d38ddbe71be78c2
SHA1

4982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256

dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512

d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
SSDEEP

12288:YGKSH3TvrnDfbXzhL/gWmmfsMsNWUZV8le27t7mZOljg5fAQTQWtGCgd1ScnQMy://kGCg2+QG9Sts

Score

10^/10

redline cong discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

Cong

C2

199.115.193.171:48258

Attributes

auth_value
aecbeec46b8431628af8ba12e4621a71

Targets

- Target
  
  dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
- Size
  
  895KB
- MD5
  
  3c62500496bfc4f35d38ddbe71be78c2
- SHA1
  
  4982a2fb4963f1f574a9ee1e5d02c429148c5e70
- SHA256
  
  dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
- SHA512
  
  d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
- SSDEEP
  
  12288:YGKSH3TvrnDfbXzhL/gWmmfsMsNWUZV8le27t7mZOljg5fAQTQWtGCgd1ScnQMy://kGCg2+QG9Sts
Score

10^/10

redline cong discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinecongdiscoveryinfostealerspywarestealer