redline | a9f0e16686996a97ebd56a1fc14348dd80bfec70ae76ae809183b1afeeefe4b2 | Triage

Sharing

General

Target

a9f0e16686996a97ebd56a1fc14348dd80bfec70ae76ae809183b1afeeefe4b2
Size

771KB
Sample

230529-d9btyahe33
MD5

9b0600e7e58491c9499b5566d347f7f1
SHA1

37abf3b7ed12301770a48261f9e54c2c82dde1af
SHA256

a9f0e16686996a97ebd56a1fc14348dd80bfec70ae76ae809183b1afeeefe4b2
SHA512

99fee8968dac3c26d9af9b84fc61d509d06da17ae5fe6a1a914ace55940e3b1ba6ae9bdd3fc2fdb39185680148c745a939831aa3c8c13ac2b8c8d284888c2258
SSDEEP

12288:nMrMy90qIIFrGHwQoyRZ4tsD+gIpivgLgmcPu9YUzsUR90Rvh/OkT/kejzsKw1:vyl9T4as5fgLgmoujzsO90PBbDjzsF1

Score

10^/10

redline disa infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

disa

C2

83.97.73.122:19062

Attributes

auth_value
93f8c4ca7000e3381dd4b6b86434de05

Targets

- Target
  
  a9f0e16686996a97ebd56a1fc14348dd80bfec70ae76ae809183b1afeeefe4b2
- Size
  
  771KB
- MD5
  
  9b0600e7e58491c9499b5566d347f7f1
- SHA1
  
  37abf3b7ed12301770a48261f9e54c2c82dde1af
- SHA256
  
  a9f0e16686996a97ebd56a1fc14348dd80bfec70ae76ae809183b1afeeefe4b2
- SHA512
  
  99fee8968dac3c26d9af9b84fc61d509d06da17ae5fe6a1a914ace55940e3b1ba6ae9bdd3fc2fdb39185680148c745a939831aa3c8c13ac2b8c8d284888c2258
- SSDEEP
  
  12288:nMrMy90qIIFrGHwQoyRZ4tsD+gIpivgLgmcPu9YUzsUR90Rvh/OkT/kejzsKw1:vyl9T4as5fgLgmoujzsO90PBbDjzsF1
Score

10^/10

redline disa infostealer persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinedisainfostealerpersistence

behavioral2

redlinedisainfostealerpersistence