redline | fb0aaca253997e0ea4e9b98adf035c429c4d70b28f57631023e6632d081039ec | Triage

Sharing

General

Target

fb0aaca253997e0ea4e9b98adf035c429c4d70b28f57631023e6632d081039ec
Size

1.1MB
Sample

230514-kmvrvsdf2z
MD5

3b92c7e5459ebf81e7755b4a1a78a864
SHA1

d82ee6e506d1a7138b94809a8bfa3edb11394bb2
SHA256

fb0aaca253997e0ea4e9b98adf035c429c4d70b28f57631023e6632d081039ec
SHA512

92c0be501f986b33268eebf12016fa6da087fc6fd4546ed8f4cdc18ccb35b33153fa3bac169aacd937844502526260e92848fdb7fb2aad0ecf90ad10593777ca
SSDEEP

24576:Ry9bRNPvH9rruYpS/56yq8vWc4r+HrdFrcLI+++EniAsD:E9ll/9npY50wdNcI+EniAs

Score

10^/10

redline luka evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes

auth_value
44560bcd37d6bf076da309730fdb519a

Targets

- Target
  
  fb0aaca253997e0ea4e9b98adf035c429c4d70b28f57631023e6632d081039ec
- Size
  
  1.1MB
- MD5
  
  3b92c7e5459ebf81e7755b4a1a78a864
- SHA1
  
  d82ee6e506d1a7138b94809a8bfa3edb11394bb2
- SHA256
  
  fb0aaca253997e0ea4e9b98adf035c429c4d70b28f57631023e6632d081039ec
- SHA512
  
  92c0be501f986b33268eebf12016fa6da087fc6fd4546ed8f4cdc18ccb35b33153fa3bac169aacd937844502526260e92848fdb7fb2aad0ecf90ad10593777ca
- SSDEEP
  
  24576:Ry9bRNPvH9rruYpS/56yq8vWc4r+HrdFrcLI+++EniAsD:E9ll/9npY50wdNcI+EniAs
Score

10^/10

redline luka evasion infostealer persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinelukaevasioninfostealerpersistencetrojan