redline | c2d02cf4cbf2a8ec6d2db0757d731710af1c1ffeb324ba5b99283aae7ed359e7 | Triage

Sharing

General

Target

c2d02cf4cbf2a8ec6d2db0757d731710af1c1ffeb324ba5b99283aae7ed359e7
Size

1.9MB
Sample

231203-l5h2fsbc38
MD5

ea0cad20b091c3f98ed9cd46d99d8bdc
SHA1

7200e78716104aa10cf43d6382a3460703acfd97
SHA256

c2d02cf4cbf2a8ec6d2db0757d731710af1c1ffeb324ba5b99283aae7ed359e7
SHA512

6c247c78d1651332aabcb0464fc796f24cc47dff03af22c5f17d37ef034f7be80ca5fee908350c089459630f54a60a81085d97be612c1a939165003aa05fee8e
SSDEEP

24576:d6Ai8kW9g4HOXiyABkaZW54Cw6Yx6a9DhvhS95P:UArHOXiyQq476Yx6a3vkjP

Score

10^/10

redline new1 infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

new1

C2

193.233.132.4:1285

Targets

- Target
  
  c2d02cf4cbf2a8ec6d2db0757d731710af1c1ffeb324ba5b99283aae7ed359e7
- Size
  
  1.9MB
- MD5
  
  ea0cad20b091c3f98ed9cd46d99d8bdc
- SHA1
  
  7200e78716104aa10cf43d6382a3460703acfd97
- SHA256
  
  c2d02cf4cbf2a8ec6d2db0757d731710af1c1ffeb324ba5b99283aae7ed359e7
- SHA512
  
  6c247c78d1651332aabcb0464fc796f24cc47dff03af22c5f17d37ef034f7be80ca5fee908350c089459630f54a60a81085d97be612c1a939165003aa05fee8e
- SSDEEP
  
  24576:d6Ai8kW9g4HOXiyABkaZW54Cw6Yx6a9DhvhS95P:UArHOXiyQq476Yx6a3vkjP
Score

10^/10

redline new1 infostealer spyware
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

redlinenew1infostealerspyware