redline | b2d23fafe1cfea07bdbdd84beac4426d53b0a2261dd2bccc7d439c07e6f7bab9 | Triage

Sharing

General

Target

b2d23fafe1cfea07bdbdd84beac4426d53b0a2261dd2bccc7d439c07e6f7bab9
Size

306KB
Sample

240424-rt9ypabe66
MD5

d21991fd53e5e7b426238e24cd41e81c
SHA1

540ea3b1769dc0b68571e04570665a2288753814
SHA256

b2d23fafe1cfea07bdbdd84beac4426d53b0a2261dd2bccc7d439c07e6f7bab9
SHA512

b056b3dc25bde6e169cf79eca9751e66599fdc79c21d68a63df2f07af9273e62cf4ceb14a06da6e6f06fdcea6fc59afb6ba61696d25d1c01bb9b7841d443c4a0
SSDEEP

6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/

Score

10^/10

redline spoo discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

spoo

C2

103.113.70.99:2630

Targets

- Target
  
  b2d23fafe1cfea07bdbdd84beac4426d53b0a2261dd2bccc7d439c07e6f7bab9
- Size
  
  306KB
- MD5
  
  d21991fd53e5e7b426238e24cd41e81c
- SHA1
  
  540ea3b1769dc0b68571e04570665a2288753814
- SHA256
  
  b2d23fafe1cfea07bdbdd84beac4426d53b0a2261dd2bccc7d439c07e6f7bab9
- SHA512
  
  b056b3dc25bde6e169cf79eca9751e66599fdc79c21d68a63df2f07af9273e62cf4ceb14a06da6e6f06fdcea6fc59afb6ba61696d25d1c01bb9b7841d443c4a0
- SSDEEP
  
  6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Score

10^/10

redline spoo discovery infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

redlinespoodiscoveryinfostealer

behavioral2

redlinespooinfostealer