redline | 548f9baf1957a63da64497aa6129440eb22d01f7ad68bc446a18a207f17ac0c0 | Triage

Sharing

General

Target

548f9baf1957a63da64497aa6129440eb22d01f7ad68bc446a18a207f17ac0c0
Size

306KB
Sample

240424-rkpldsbc77
MD5

eb2a3c3ec9ac5d71070eaf70fb6d2892
SHA1

89afdc8b2b99d58c7b0e3b3f75010d57cfd3baf5
SHA256

548f9baf1957a63da64497aa6129440eb22d01f7ad68bc446a18a207f17ac0c0
SHA512

8a03d66039c8385b93f40b113bf6283b207cb1b0d73d510d5d4019e0e47b78fef062918a3d08246511a35ad5221141c67984e3a795002c5ee8ab707a2b2675dc
SSDEEP

6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/

Score

10^/10

redline spoo discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

spoo

C2

103.113.70.99:2630

Targets

- Target
  
  548f9baf1957a63da64497aa6129440eb22d01f7ad68bc446a18a207f17ac0c0
- Size
  
  306KB
- MD5
  
  eb2a3c3ec9ac5d71070eaf70fb6d2892
- SHA1
  
  89afdc8b2b99d58c7b0e3b3f75010d57cfd3baf5
- SHA256
  
  548f9baf1957a63da64497aa6129440eb22d01f7ad68bc446a18a207f17ac0c0
- SHA512
  
  8a03d66039c8385b93f40b113bf6283b207cb1b0d73d510d5d4019e0e47b78fef062918a3d08246511a35ad5221141c67984e3a795002c5ee8ab707a2b2675dc
- SSDEEP
  
  6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Score

10^/10

redline spoo infostealer discovery spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinespooinfostealer

behavioral2

redlinespoodiscoveryinfostealerspywarestealer