redline | 291ef0eed4c315c8e592790e2d42a760602f111310017855802ba2d95c3dfe99 | Triage

Sharing

General

Target

291ef0eed4c315c8e592790e2d42a760602f111310017855802ba2d95c3dfe99
Size

305KB
Sample

240424-qhj3fsae7z
MD5

09beca16373bf5d45e90c22687d6cda3
SHA1

5c9a7590584d5b10c8f710aaf63f9902d738b4f4
SHA256

291ef0eed4c315c8e592790e2d42a760602f111310017855802ba2d95c3dfe99
SHA512

0d9dc0728e41711529cfc80d2e3b8ca61672df1db101ad84287b77fa905cc8bcbc3f93e1529eda4b229887dafd1651ccfd479c88114b003d62776030ec46279a
SSDEEP

6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/

Score

10^/10

redline spoo discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

spoo

C2

103.113.70.99:2630

Targets

- Target
  
  291ef0eed4c315c8e592790e2d42a760602f111310017855802ba2d95c3dfe99
- Size
  
  305KB
- MD5
  
  09beca16373bf5d45e90c22687d6cda3
- SHA1
  
  5c9a7590584d5b10c8f710aaf63f9902d738b4f4
- SHA256
  
  291ef0eed4c315c8e592790e2d42a760602f111310017855802ba2d95c3dfe99
- SHA512
  
  0d9dc0728e41711529cfc80d2e3b8ca61672df1db101ad84287b77fa905cc8bcbc3f93e1529eda4b229887dafd1651ccfd479c88114b003d62776030ec46279a
- SSDEEP
  
  6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Score

10^/10

redline spoo infostealer discovery spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinespooinfostealer

behavioral2

redlinespoodiscoveryinfostealerspywarestealer