redline | 5fca768c183d09378e2f7d60044083cd6cf216dab08b32df0199a168304938a6 | Triage

Sharing

General

Target

5fca768c183d09378e2f7d60044083cd6cf216dab08b32df0199a168304938a6
Size

1.7MB
Sample

230507-c3r2xagd3v
MD5

25d7b5a3aa8e9df9e12b41fed9ba8e7c
SHA1

e9c8612ca64b3527034c4c580f55c548572e6e5c
SHA256

5fca768c183d09378e2f7d60044083cd6cf216dab08b32df0199a168304938a6
SHA512

8279127f92f5668fb7f8f3277234e66d5245e880b4020cf9bebabd9ad59c35bda3d25d483e9788b8507aba1568bc30934917a3abe8a581ed918a84e3f624e1a2
SSDEEP

49152:UqOTZV1YmbNltm1Skk25EQaFUPDlJN8G6qHx8oGI:w1zYmHtm1Skk2yQaFylJf

Score

10^/10

redline gena most evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Targets

- Target
  
  5fca768c183d09378e2f7d60044083cd6cf216dab08b32df0199a168304938a6
- Size
  
  1.7MB
- MD5
  
  25d7b5a3aa8e9df9e12b41fed9ba8e7c
- SHA1
  
  e9c8612ca64b3527034c4c580f55c548572e6e5c
- SHA256
  
  5fca768c183d09378e2f7d60044083cd6cf216dab08b32df0199a168304938a6
- SHA512
  
  8279127f92f5668fb7f8f3277234e66d5245e880b4020cf9bebabd9ad59c35bda3d25d483e9788b8507aba1568bc30934917a3abe8a581ed918a84e3f624e1a2
- SSDEEP
  
  49152:UqOTZV1YmbNltm1Skk25EQaFUPDlJN8G6qHx8oGI:w1zYmHtm1Skk2yQaFylJf
Score

10^/10

redline gena most evasion infostealer persistence trojan stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinegenamostevasioninfostealerpersistencetrojan

behavioral2

redlinegenamostevasioninfostealerpersistencestealertrojan