redline

General

Target
file.exe
Size 1.1MB
Sample231012-zmkdfsdc86
SHA256 78021d077fab98faec6d33eeaba4db8065c0ed42bd318a54fcac145dbe0585dc
MD5 91fd86e63ce500f01b44ea6323eb7b1b
SHA1 3dd59df60af746c460eb94c892e6ea6748d7619a
SHA512 4f51d4ce988b08360da801c73a6cacf75669b560fc7123df5f0f7defba377b463155c97955c9a9aa3f2183e3a7144cd3925af172c5d9f9676e8342cf50959356
SSDEEP 12288:JrRhpJYRRt16tC2KlUT7rjZfte9mjaLFUewDfuAoUAF66K78WKrNhcUv4:JZJYRRt16tC2KyvHfaLBwHV6K4WQ6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

unique285

C2

194.169.175.232:45451

Targets

- Target
  file.exe
- Size 1.1MB
- SHA256 78021d077fab98faec6d33eeaba4db8065c0ed42bd318a54fcac145dbe0585dc
- MD5 91fd86e63ce500f01b44ea6323eb7b1b
- SHA1 3dd59df60af746c460eb94c892e6ea6748d7619a
- SHA512 4f51d4ce988b08360da801c73a6cacf75669b560fc7123df5f0f7defba377b463155c97955c9a9aa3f2183e3a7144cd3925af172c5d9f9676e8342cf50959356
- SSDEEP 12288:JrRhpJYRRt16tC2KlUT7rjZfte9mjaLFUewDfuAoUAF66K78WKrNhcUv4:JZJYRRt16tC2KyvHfaLBwHV6K4WQ6
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline unique285 infostealer spyware
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2