redline | f253afd3fe057085b30cb4cfd5c0a027a4bfebe58812279ac469a48fc57be139 | Triage

Sharing

General

Target

f253afd3fe057085b30cb4cfd5c0a027a4bfebe58812279ac469a48fc57be139
Size

1.1MB
Sample

230514-kyk2ssdf8x
MD5

f25435a51ec3b14d0b17dd3c16ed8443
SHA1

a6c9920d1c8662c0dab591e4c976f5d2a6469103
SHA256

f253afd3fe057085b30cb4cfd5c0a027a4bfebe58812279ac469a48fc57be139
SHA512

cf8dca6aefdd4093271f259a0ab681435d3a160b140fb254386646ae80533529cc6352061426a55d729780d0bd24c2c20f00908afafba7ba49a142d3ba08e868
SSDEEP

24576:kydmFcg6LjPAz4Oo8akUFOwexYn0OkkurEoMA38QVjSb+nFmRe0aG:zkFcg6LjPLrEUsrL/MApjoiie0a

Score

10^/10

redline luka evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

luka

C2

185.161.248.75:4132

Attributes

auth_value
44560bcd37d6bf076da309730fdb519a

Targets

- Target
  
  f253afd3fe057085b30cb4cfd5c0a027a4bfebe58812279ac469a48fc57be139
- Size
  
  1.1MB
- MD5
  
  f25435a51ec3b14d0b17dd3c16ed8443
- SHA1
  
  a6c9920d1c8662c0dab591e4c976f5d2a6469103
- SHA256
  
  f253afd3fe057085b30cb4cfd5c0a027a4bfebe58812279ac469a48fc57be139
- SHA512
  
  cf8dca6aefdd4093271f259a0ab681435d3a160b140fb254386646ae80533529cc6352061426a55d729780d0bd24c2c20f00908afafba7ba49a142d3ba08e868
- SSDEEP
  
  24576:kydmFcg6LjPAz4Oo8akUFOwexYn0OkkurEoMA38QVjSb+nFmRe0aG:zkFcg6LjPLrEUsrL/MApjoiie0a
Score

10^/10

redline luka evasion infostealer persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinelukaevasioninfostealerpersistencetrojan