redline | 2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a | Triage

Sharing

General

Target

2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a
Size

727KB
Sample

230605-smdgkshh5s
MD5

cc5e53ac466ebf0bcf42563f87c3d6b3
SHA1

e8872c01c5d774f0773c2814804fe1f493ce5e56
SHA256

2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a
SHA512

6e7550182e3f23b4e17a1ddfff6d136b7bbe84f166f3c2d4c808d0c018718b3e0c53fb716ba6ed206d3c02a21ce1b5c5da047616600bbfcc878e27cc2a0248f2
SSDEEP

12288:DMrCy90JSLK1hinUGqPmpKAZ8de71rBDdkaH/B8Z6pyIiH6jFU:hyryhinPqwrZGezJkafB8ZeybH6jy

Score

10^/10

redline diza maxi metro evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

metro

C2

83.97.73.126:19048

Attributes

auth_value
f7fd4aa816bdbaad933b45b51d9b6b1a

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19048

Attributes

auth_value
0d09b419c8bc967f91c68be4a17e92ee

Targets

- Target
  
  2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a
- Size
  
  727KB
- MD5
  
  cc5e53ac466ebf0bcf42563f87c3d6b3
- SHA1
  
  e8872c01c5d774f0773c2814804fe1f493ce5e56
- SHA256
  
  2542575c96389e587488552e829b3be87ab507c8eb97cc83b4fc7d1e7c73ab9a
- SHA512
  
  6e7550182e3f23b4e17a1ddfff6d136b7bbe84f166f3c2d4c808d0c018718b3e0c53fb716ba6ed206d3c02a21ce1b5c5da047616600bbfcc878e27cc2a0248f2
- SSDEEP
  
  12288:DMrCy90JSLK1hinUGqPmpKAZ8de71rBDdkaH/B8Z6pyIiH6jFU:hyryhinPqwrZGezJkafB8ZeybH6jy
Score

10^/10

redline diza maxi metro evasion infostealer persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Disabling Security Tools

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinedizamaximetroevasioninfostealerpersistencetrojan