redline | 135d50c788d5044d1652df071c11b49e6728d2962def469ab59b3f4e2d805afd | Triage

Sharing

General

Target

135d50c788d5044d1652df071c11b49e6728d2962def469ab59b3f4e2d805afd
Size

305KB
Sample

240424-nntgzahd29
MD5

2c5e733a4078cfe7193be7e99769c401
SHA1

9bf265fcfcbd1980b6b3cfb79b899172987bbaa3
SHA256

135d50c788d5044d1652df071c11b49e6728d2962def469ab59b3f4e2d805afd
SHA512

59b0b766d9bc678fbadb5519d6b423db1def63c77f7e5ac81b59ecb6dc4d70655d367eaa0466436c9d359571a72f740dd63c9fcb7a3843740e334552eccd0252
SSDEEP

6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/

Score

10^/10

redline spoo discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

spoo

C2

103.113.70.99:2630

Targets

- Target
  
  135d50c788d5044d1652df071c11b49e6728d2962def469ab59b3f4e2d805afd
- Size
  
  305KB
- MD5
  
  2c5e733a4078cfe7193be7e99769c401
- SHA1
  
  9bf265fcfcbd1980b6b3cfb79b899172987bbaa3
- SHA256
  
  135d50c788d5044d1652df071c11b49e6728d2962def469ab59b3f4e2d805afd
- SHA512
  
  59b0b766d9bc678fbadb5519d6b423db1def63c77f7e5ac81b59ecb6dc4d70655d367eaa0466436c9d359571a72f740dd63c9fcb7a3843740e334552eccd0252
- SSDEEP
  
  6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Score

10^/10

redline spoo discovery infostealer spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinespoodiscoveryinfostealerspywarestealer

behavioral2

redlinespooinfostealerspywarestealer