redline | ce11935dfd2cf99bb57b5533180cc2c167ba208e63377d073dbac140a0448d77 | Triage

Sharing

General

Target

0x0006000000014b27-112.dat
Size

172KB
Sample

230611-aex7xagb26
MD5

7c100d439deab00876d797cfa2f7f6e8
SHA1

3a77ae161840b12fa817e7d2a367a8f77c8a0f44
SHA256

ce11935dfd2cf99bb57b5533180cc2c167ba208e63377d073dbac140a0448d77
SHA512

e3bfc85043a9b829e944b16147745338eceacf52d43f364773f325ff0089f1dece0390a7d91a16dde23db170ba04bcd6010a31d9961505f7185317aad237b965
SSDEEP

3072:QUYvpRfFyNgq8oMGl9ixNcO3qdLbkSh8e8hb:kVoVrLbkSh

Score

10^/10

redline duha discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

duha

C2

83.97.73.129:19068

Attributes

auth_value
aafe99874c3b8854069470882e00246c

Targets

- Target
  
  0x0006000000014b27-112.dat
- Size
  
  172KB
- MD5
  
  7c100d439deab00876d797cfa2f7f6e8
- SHA1
  
  3a77ae161840b12fa817e7d2a367a8f77c8a0f44
- SHA256
  
  ce11935dfd2cf99bb57b5533180cc2c167ba208e63377d073dbac140a0448d77
- SHA512
  
  e3bfc85043a9b829e944b16147745338eceacf52d43f364773f325ff0089f1dece0390a7d91a16dde23db170ba04bcd6010a31d9961505f7185317aad237b965
- SSDEEP
  
  3072:QUYvpRfFyNgq8oMGl9ixNcO3qdLbkSh8e8hb:kVoVrLbkSh
Score

10^/10

redline duha discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlineduhadiscoveryinfostealerspywarestealer

behavioral2