redline | 9e932710346a17419923f88d282fc72ddf97e3d473cdbe4122a89f2d8477f3ab | Triage

Sharing

General

Target

9e932710346a17419923f88d282fc72ddf97e3d473cdbe4122a89f2d8477f3ab
Size

661KB
Sample

230912-mf36rsec87
MD5

dc4f3761f8f3a3c14d84c3afa4827717
SHA1

dc9f071ac9cd0cfda5ffc24611a0629aec05bc14
SHA256

9e932710346a17419923f88d282fc72ddf97e3d473cdbe4122a89f2d8477f3ab
SHA512

8d82b4e4d45ed2b68d711e052cff8b060e6859f22dddf6a3a1240b0b573a3eef581975b7fc07317371ddeee1ea5f64e4cc811824f10dc2bd2a6495f81c22347c
SSDEEP

12288:XMrCy90Zg2g65GEfAggQd+6Jcn4nHnyvKWF86gch7d0ZpSs:NyIg2g65GEfAggf6LHyiWF8nws

Score

10^/10

redline virad infostealer persistence

Malware Config

Extracted

Family

redline

Botnet

virad

C2

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Targets

- Target
  
  9e932710346a17419923f88d282fc72ddf97e3d473cdbe4122a89f2d8477f3ab
- Size
  
  661KB
- MD5
  
  dc4f3761f8f3a3c14d84c3afa4827717
- SHA1
  
  dc9f071ac9cd0cfda5ffc24611a0629aec05bc14
- SHA256
  
  9e932710346a17419923f88d282fc72ddf97e3d473cdbe4122a89f2d8477f3ab
- SHA512
  
  8d82b4e4d45ed2b68d711e052cff8b060e6859f22dddf6a3a1240b0b573a3eef581975b7fc07317371ddeee1ea5f64e4cc811824f10dc2bd2a6495f81c22347c
- SSDEEP
  
  12288:XMrCy90Zg2g65GEfAggQd+6Jcn4nHnyvKWF86gch7d0ZpSs:NyIg2g65GEfAggf6LHyiWF8nws
Score

10^/10

redline virad infostealer persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

redlineviradinfostealerpersistence