redline

General

Target

0x0008000000012318-1069.dat
Size

175KB
Sample

230327-2jh3bsff66
MD5

17b5777fb6e36f15e9f4cb6f0f503a25
SHA1

d3fa33547222188d114308998cc54e6add919bc0
SHA256

6f07a9b86c3c77df4cabfa988dffc16dd6830ea9afabecf0bcbcef62021b0f47
SHA512

c35259398f7a2d079be7e0aa1dc61538249417492d15a48b369b0750c55f5e91ca1d3dc2550501c330b7479c466fe285682d6631de69dcb220a72c97e12dcebc
SSDEEP

3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

renta

C2

176.113.115.145:4125

Attributes

auth_value
359596fd5b36e9925ade4d9a1846bafb

Targets

- Target
  
  0x0008000000012318-1069.dat
- Size
  
  175KB
- MD5
  
  17b5777fb6e36f15e9f4cb6f0f503a25
- SHA1
  
  d3fa33547222188d114308998cc54e6add919bc0
- SHA256
  
  6f07a9b86c3c77df4cabfa988dffc16dd6830ea9afabecf0bcbcef62021b0f47
- SHA512
  
  c35259398f7a2d079be7e0aa1dc61538249417492d15a48b369b0750c55f5e91ca1d3dc2550501c330b7479c466fe285682d6631de69dcb220a72c97e12dcebc
- SSDEEP
  
  3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh
Score

10^/10

redline renta discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2