redline | 5c49d9f3f398e7bf0aa48b300bb1f1e8c60f39583ffdbbef574648afedf5a2d0 | Triage

Sharing

General

Target

5c49d9f3f398e7bf0aa48b300bb1f1e8c60f39583ffdbbef574648afedf5a2d0.bin
Size

1.6MB
Sample

230507-cxjhksea72
MD5

aec89ff0b1a792b6e454239c91e209b8
SHA1

6cf3f5866bbddfcc5ba1fd98241502e354c9735a
SHA256

5c49d9f3f398e7bf0aa48b300bb1f1e8c60f39583ffdbbef574648afedf5a2d0
SHA512

fb3096573d768549cdf6716150f6d8198edeb02224ff7ab9241da522a86248b50f795dd50179b1b5180e03247848c4f590f66f324ce4cf3873c9481f5f8bc6e7
SSDEEP

24576:EysIEELq7XWiVAz+QMXMfHot6goAP1JBni2ctmrIIGwWLPbDvtWnA:TsIE+CtWz+9XMfItr5XBn6c4nnz8

Score

10^/10

redline gena most evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes

auth_value
d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes

auth_value
7da4dfa153f2919e617aa016f7c36008

Targets

- Target
  
  5c49d9f3f398e7bf0aa48b300bb1f1e8c60f39583ffdbbef574648afedf5a2d0.bin
- Size
  
  1.6MB
- MD5
  
  aec89ff0b1a792b6e454239c91e209b8
- SHA1
  
  6cf3f5866bbddfcc5ba1fd98241502e354c9735a
- SHA256
  
  5c49d9f3f398e7bf0aa48b300bb1f1e8c60f39583ffdbbef574648afedf5a2d0
- SHA512
  
  fb3096573d768549cdf6716150f6d8198edeb02224ff7ab9241da522a86248b50f795dd50179b1b5180e03247848c4f590f66f324ce4cf3873c9481f5f8bc6e7
- SSDEEP
  
  24576:EysIEELq7XWiVAz+QMXMfHot6goAP1JBni2ctmrIIGwWLPbDvtWnA:TsIE+CtWz+9XMfItr5XBn6c4nnz8
Score

10^/10

redline gena most evasion infostealer persistence trojan stealer
- Detects Redline Stealer samples
  This rule detects the presence of Redline Stealer samples based on their unique strings.
  stealer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinegenamostevasioninfostealerpersistencetrojan

behavioral2

redlinegenamostevasioninfostealerpersistencestealertrojan