redline | bcc002ad34a101e769e44a8c7beb2f3ddb4baa021ad98fcfa6fe8537ddd7e88b | Triage

Sharing

General

Target

bcc002ad34a101e769e44a8c7beb2f3ddb4baa021ad98fcfa6fe8537ddd7e88b
Size

1.1MB
Sample

230514-1tsh3sdf96
MD5

5db6ea10b4754c85ee84f142ee2c0195
SHA1

337e48bf1dda272c9111ea7d746f976db82b38cd
SHA256

bcc002ad34a101e769e44a8c7beb2f3ddb4baa021ad98fcfa6fe8537ddd7e88b
SHA512

595c4f24e0c1c3a1d4e63a77a8a8841cd59197fe21ce0125f5a1eba89bfd9de99e5fa7cecaa1dd3bfd01d86da9f71aea7d1eaac644202bbb79eca568e91c70d2
SSDEEP

24576:UyNI4pqAVhCwpzOgDXLapdubemm9y2OBvI9E2JTi7g2EYgAsf5A:jNvqAmwTXGpdYrmYpw93TUZfgAs

Score

10^/10

redline linda evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

linda

C2

185.161.248.75:4132

Attributes

auth_value
21cdc21d041667b9c1679f88a1146770

Targets

- Target
  
  bcc002ad34a101e769e44a8c7beb2f3ddb4baa021ad98fcfa6fe8537ddd7e88b
- Size
  
  1.1MB
- MD5
  
  5db6ea10b4754c85ee84f142ee2c0195
- SHA1
  
  337e48bf1dda272c9111ea7d746f976db82b38cd
- SHA256
  
  bcc002ad34a101e769e44a8c7beb2f3ddb4baa021ad98fcfa6fe8537ddd7e88b
- SHA512
  
  595c4f24e0c1c3a1d4e63a77a8a8841cd59197fe21ce0125f5a1eba89bfd9de99e5fa7cecaa1dd3bfd01d86da9f71aea7d1eaac644202bbb79eca568e91c70d2
- SSDEEP
  
  24576:UyNI4pqAVhCwpzOgDXLapdubemm9y2OBvI9E2JTi7g2EYgAsf5A:jNvqAmwTXGpdYrmYpw93TUZfgAs
Score

10^/10

redline linda evasion infostealer persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinelindaevasioninfostealerpersistencetrojan