redline | a3aeca8b5d9a6533bdd64fa1dbb18fadf395dc259e7824e4c1f30aef60927c52 | Triage

Sharing

General

Target

a3aeca8b5d9a6533bdd64fa1dbb18fadf395dc259e7824e4c1f30aef60927c52
Size

308KB
Sample

230608-rlsz7sga28
MD5

11a4465d2a904c4cee13c7d85f75e4b8
SHA1

bb6de2817726b5c3e59cbe8ce7796d9ee6714e17
SHA256

a3aeca8b5d9a6533bdd64fa1dbb18fadf395dc259e7824e4c1f30aef60927c52
SHA512

e0d4c808b4c45c0cbdbf04c46db4e65999f4d375a32158ef334276aca1a789fe5dbc89303374fdf9d9ca31aa90e81bb806d9058111ffb1005b5cf14a4174443e
SSDEEP

6144:FJie0RFHCXwvTygXUNVS4MGh1aBFrvz1xcxcVtDP:FJoRDyR1aBFrvz1xcxyDP

Score

10^/10

redline sheron infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes

auth_value
2d067e7e2372227d3a03b335260112e9

Targets

- Target
  
  a3aeca8b5d9a6533bdd64fa1dbb18fadf395dc259e7824e4c1f30aef60927c52
- Size
  
  308KB
- MD5
  
  11a4465d2a904c4cee13c7d85f75e4b8
- SHA1
  
  bb6de2817726b5c3e59cbe8ce7796d9ee6714e17
- SHA256
  
  a3aeca8b5d9a6533bdd64fa1dbb18fadf395dc259e7824e4c1f30aef60927c52
- SHA512
  
  e0d4c808b4c45c0cbdbf04c46db4e65999f4d375a32158ef334276aca1a789fe5dbc89303374fdf9d9ca31aa90e81bb806d9058111ffb1005b5cf14a4174443e
- SSDEEP
  
  6144:FJie0RFHCXwvTygXUNVS4MGh1aBFrvz1xcxcVtDP:FJoRDyR1aBFrvz1xcxyDP
Score

10^/10

redline sheron infostealer spyware
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinesheroninfostealerspyware