redline | 53be6d6661ac7b6185ec08c22540de7734d59078e763f73cadfa963d5db6dd58 | Triage

Sharing

General

Target

53be6d6661ac7b6185ec08c22540de7734d59078e763f73cadfa963d5db6dd58
Size

661KB
Sample

230912-mdcwssec76
MD5

d0b6fe5834ff3566aac6851fa13665e0
SHA1

7c5e1dfcf9cc7705a5bd0a87270d39278ca36482
SHA256

53be6d6661ac7b6185ec08c22540de7734d59078e763f73cadfa963d5db6dd58
SHA512

238fe288045d44851f7770fe5007a46600a5e9f5615ba65c4d74caea4af8f0582a43653312abccddc4eb461d920ad86206fd7700a11f281f8aeaa83af866ca45
SSDEEP

12288:wMrZy906QrvAan+x9xSb2sQcrmHFOCYoa/G/pSIUTpKy:5yIb4uQcrmlRYZ0UF/

Score

10^/10

redline virad infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

virad

C2

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Targets

- Target
  
  53be6d6661ac7b6185ec08c22540de7734d59078e763f73cadfa963d5db6dd58
- Size
  
  661KB
- MD5
  
  d0b6fe5834ff3566aac6851fa13665e0
- SHA1
  
  7c5e1dfcf9cc7705a5bd0a87270d39278ca36482
- SHA256
  
  53be6d6661ac7b6185ec08c22540de7734d59078e763f73cadfa963d5db6dd58
- SHA512
  
  238fe288045d44851f7770fe5007a46600a5e9f5615ba65c4d74caea4af8f0582a43653312abccddc4eb461d920ad86206fd7700a11f281f8aeaa83af866ca45
- SSDEEP
  
  12288:wMrZy906QrvAan+x9xSb2sQcrmHFOCYoa/G/pSIUTpKy:5yIb4uQcrmlRYZ0UF/
Score

10^/10

redline virad infostealer persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

redlineviradinfostealerpersistence