redline

General

Target
file.exe
Size 444KB
Sample231018-kap1vacf5y
SHA256 aa89427a86b36667ae39bcbd2ef5eb299769ce69057b889c06290e35d39a47a7
MD5 f5cfae9949e8973779c5539603f98512
SHA1 7e81a513aadcb61b6b8cd2beca7675c46d91a790
SHA512 eb84bab8cfc7a53f2f8b237434ac2b613a14550773855059e63aca0eaef600ae0f715255da21616f5eb27f3d90267c0dba15405bfc64547cd0a480348b0bb624
SSDEEP 12288:F2YwCby3hOkzj3h9t/bhblnkOudK8XpUrbKQD:F2YLAhzDt/9uOudK8XpUrbKQD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

build285

C2

194.169.175.232:45451

Targets

- Target
  file.exe
- Size 444KB
- SHA256 aa89427a86b36667ae39bcbd2ef5eb299769ce69057b889c06290e35d39a47a7
- MD5 f5cfae9949e8973779c5539603f98512
- SHA1 7e81a513aadcb61b6b8cd2beca7675c46d91a790
- SHA512 eb84bab8cfc7a53f2f8b237434ac2b613a14550773855059e63aca0eaef600ae0f715255da21616f5eb27f3d90267c0dba15405bfc64547cd0a480348b0bb624
- SSDEEP 12288:F2YwCby3hOkzj3h9t/bhblnkOudK8XpUrbKQD:F2YLAhzDt/9uOudK8XpUrbKQD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline build285 infostealer spyware
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RedLine payload

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2