redline | 95a09a2609d838abca7d4c252fe9fa44a337901810b2db2945673726ffc36b66 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

03b2ae8566...31.exe

windows7-x64

03b2ae8566...31.exe

windows10-2004-x64

Sharing

General

Target

03b2ae85666c1774e0e0136153925b31.exe
Size

329KB
Sample

230703-cneg9sff2w
MD5

03b2ae85666c1774e0e0136153925b31
SHA1

e1bdea5f79ab9d51ff031ea372e264674c2fe0a5
SHA256

95a09a2609d838abca7d4c252fe9fa44a337901810b2db2945673726ffc36b66
SHA512

f2baf3cdfc4d34779dc243e28c8b0389db17e57772e44b8d4eb101891a635307ccee857afbfe015738c06ea451462a74e44bacefeb3509ca82ce83e71e8ca42a
SSDEEP

6144:uLy3r9rtnlggYV0yQ8/ZzkZfD4V7cwCldOz1yhXGY9lFRLt:uer9pllYV0M/pQ87KPOzEhJp

Score

10^/10

redline discovery infostealer spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

03b2ae85666c1774e0e0136153925b31.exe

Resource

win7-20230621-en

redline discovery infostealer spyware stealer

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

03b2ae85666c1774e0e0136153925b31.exe

Resource

win10v2004-20230621-en

redline discovery infostealer spyware stealer

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  03b2ae85666c1774e0e0136153925b31.exe
- Size
  
  329KB
- MD5
  
  03b2ae85666c1774e0e0136153925b31
- SHA1
  
  e1bdea5f79ab9d51ff031ea372e264674c2fe0a5
- SHA256
  
  95a09a2609d838abca7d4c252fe9fa44a337901810b2db2945673726ffc36b66
- SHA512
  
  f2baf3cdfc4d34779dc243e28c8b0389db17e57772e44b8d4eb101891a635307ccee857afbfe015738c06ea451462a74e44bacefeb3509ca82ce83e71e8ca42a
- SSDEEP
  
  6144:uLy3r9rtnlggYV0yQ8/ZzkZfD4V7cwCldOz1yhXGY9lFRLt:uer9pllYV0M/pQ87KPOzEhJp
Score

10^/10

redline discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinediscoveryinfostealerspywarestealer

behavioral2

redlinediscoveryinfostealerspywarestealer

© 2018-2025

Terms | Privacy