redline

General

Target

2c7c2abddadddc4eb190d66c65412fe8.exe
Size

738KB
Sample

230606-s7lzfsfa6y
MD5

2c7c2abddadddc4eb190d66c65412fe8
SHA1

0aaa7f6509d1f33da676a510b06a2c0379818f20
SHA256

51f0ef264a73c56b191eeeca19c29cd70d445e5b2f110176d9c21a681838c42a
SHA512

9589372d81d7056b9b88b93297ad3b85600d7e5bfce224bde022f9cf669bc7fa45dbad60376d3a3834c79615c2ac509d9b9471f0513fd313e8a58d4887bb4e1f
SSDEEP

12288:OMrey90ArTyG78Vwy8jsyFFXI0NB5VXeK+YyoiS42wtiBKcjZUK/jUE7:cyTTyG7V/DNHteaCPViBj2SUc

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.126:19048

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Targets

- Target
  
  2c7c2abddadddc4eb190d66c65412fe8.exe
- Size
  
  738KB
- MD5
  
  2c7c2abddadddc4eb190d66c65412fe8
- SHA1
  
  0aaa7f6509d1f33da676a510b06a2c0379818f20
- SHA256
  
  51f0ef264a73c56b191eeeca19c29cd70d445e5b2f110176d9c21a681838c42a
- SHA512
  
  9589372d81d7056b9b88b93297ad3b85600d7e5bfce224bde022f9cf669bc7fa45dbad60376d3a3834c79615c2ac509d9b9471f0513fd313e8a58d4887bb4e1f
- SSDEEP
  
  12288:OMrey90ArTyG78Vwy8jsyFFXI0NB5VXeK+YyoiS42wtiBKcjZUK/jUE7:cyTTyG7V/DNHteaCPViBj2SUc
Score

10^/10

redline maxi evasion infostealer persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies Windows Defender Real-time Protection settings

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2