redline | 28f87e7ec9e1fc5c7e5b6d3c025bd214c37cbaf117fc258d6a616fc2131db59f | Triage

Sharing

General

Target

28f87e7ec9e1fc5c7e5b6d3c025bd214c37cbaf117fc258d6a616fc2131db59f
Size

307KB
Sample

230608-svpjtagd94
MD5

672de3fc1b5b17514f6be7036e632cd1
SHA1

c0f274b048c46fd4beef608121fb7d5512582496
SHA256

28f87e7ec9e1fc5c7e5b6d3c025bd214c37cbaf117fc258d6a616fc2131db59f
SHA512

527a1edd5c18cbb99a140ba668ff0db1018753448a4ed2ee844b3fbf47f4b8798e1673b6258836aead048f1ff99bee4ce5defd9fe3413024617ed8545527d362
SSDEEP

6144:8pSOyjtRVnybHwvTygXUNVS4MGh1aBFrvz1xcxcFtRv/:8pWjtRxyR1aBFrvz1xcxiRv/

Score

10^/10

redline sheron infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

sheron

C2

83.97.73.129:19068

Attributes

auth_value
2d067e7e2372227d3a03b335260112e9

Targets

- Target
  
  28f87e7ec9e1fc5c7e5b6d3c025bd214c37cbaf117fc258d6a616fc2131db59f
- Size
  
  307KB
- MD5
  
  672de3fc1b5b17514f6be7036e632cd1
- SHA1
  
  c0f274b048c46fd4beef608121fb7d5512582496
- SHA256
  
  28f87e7ec9e1fc5c7e5b6d3c025bd214c37cbaf117fc258d6a616fc2131db59f
- SHA512
  
  527a1edd5c18cbb99a140ba668ff0db1018753448a4ed2ee844b3fbf47f4b8798e1673b6258836aead048f1ff99bee4ce5defd9fe3413024617ed8545527d362
- SSDEEP
  
  6144:8pSOyjtRVnybHwvTygXUNVS4MGh1aBFrvz1xcxcFtRv/:8pWjtRxyR1aBFrvz1xcxiRv/
Score

10^/10

redline sheron infostealer spyware
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinesheroninfostealerspyware