redline | 3a65f720bc48f5ea51dd7c073961f71332cf864ec6ae1e3469a1a284dfaabdd8 | Triage

Sharing

General

Target

3a65f720bc48f5ea51dd7c073961f71332cf864ec6ae1e3469a1a284dfaabdd8
Size

175KB
Sample

230325-q9zxzsfa9v
MD5

f197d1eb5c9a1f9e586e2438529067b6
SHA1

143d53443170406749b1a56eab31cfd532105677
SHA256

3a65f720bc48f5ea51dd7c073961f71332cf864ec6ae1e3469a1a284dfaabdd8
SHA512

d20a7f47d033257751134687f0e0da3864864e0adb6575115e827c22d5b0a5f454023607dd5b0b37f1133715e3fae20e1bd60dca8d596d9763b4def339d5f4fb
SSDEEP

3072:nxqZW8TaVMq+v3Kankbe759rhZmxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOu9:xqZP3KwkCrh

Score

10^/10

redline @redlinevipchat cloud (tg: @fatherofcarders)discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

@REDLINEVIPCHAT Cloud (TG: @FATHEROFCARDERS)

C2

151.80.89.234:19388

Attributes

auth_value
56af49c3278d982f9a41ef2abb7c4d09

Targets

- Target
  
  3a65f720bc48f5ea51dd7c073961f71332cf864ec6ae1e3469a1a284dfaabdd8
- Size
  
  175KB
- MD5
  
  f197d1eb5c9a1f9e586e2438529067b6
- SHA1
  
  143d53443170406749b1a56eab31cfd532105677
- SHA256
  
  3a65f720bc48f5ea51dd7c073961f71332cf864ec6ae1e3469a1a284dfaabdd8
- SHA512
  
  d20a7f47d033257751134687f0e0da3864864e0adb6575115e827c22d5b0a5f454023607dd5b0b37f1133715e3fae20e1bd60dca8d596d9763b4def339d5f4fb
- SSDEEP
  
  3072:nxqZW8TaVMq+v3Kankbe759rhZmxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOu9:xqZP3KwkCrh
Score

10^/10

redline @redlinevipchat cloud (tg: @fatherofcarders)discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

@redlinevipchat cloud (tg: @fatherofcarders)redline

behavioral1

redline@redlinevipchat cloud (tg: @fatherofcarders)discoveryinfostealerspywarestealer