Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Redline St...ed.exe
windows11-21h2-x64
1Redline St...ld.exe
windows11-21h2-x64
10Redline St...52.dll
windows11-21h2-x64
1Redline St...ib.dll
windows11-21h2-x64
1Redline St...UI.dll
windows11-21h2-x64
1Redline St...db.dll
windows11-21h2-x64
1Redline St...db.dll
windows11-21h2-x64
1Redline St...ks.dll
windows11-21h2-x64
1Redline St...il.dll
windows11-21h2-x64
1Redline St...on.dll
windows11-21h2-x64
1Redline St...ls.dll
windows11-21h2-x64
1Redline St...en.dll
windows11-21h2-x64
1Redline St...ib.dll
windows11-21h2-x64
1Redline St...er.exe
windows11-21h2-x64
1Redline St...et.dll
windows11-21h2-x64
1Redline St...ub.exe
windows11-21h2-x64
10Redline St...rt.bat
windows11-21h2-x64
8Redline St...ed.exe
windows11-21h2-x64
10Analysis
-
max time kernel
24s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
31/05/2024, 14:26
Behavioral task
behavioral1
Sample
Redline Stealer Builder (Modified Variant)/RedLine_Clipper_Cracked.exe
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
Redline Stealer/Libraries/Build.exe
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
Redline Stealer/Libraries/Bunifu_UI_v1.52.dll
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
Redline Stealer/Libraries/GuiLib.dll
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
Redline Stealer/Libraries/MetroSet UI.dll
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
Redline Stealer/Libraries/Mono.Cecil.Mdb.dll
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
Redline Stealer/Libraries/Mono.Cecil.Pdb.dll
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
Redline Stealer/Libraries/Mono.Cecil.Rocks.dll
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
Redline Stealer/Libraries/Mono.Cecil.dll
Resource
win11-20240426-en
Behavioral task
behavioral10
Sample
Redline Stealer/Libraries/Newtonsoft.Json.dll
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
Redline Stealer/Libraries/RedLine.SharedModels.dll
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
Redline Stealer/Libraries/System.Drawing.Pen.dll
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
Redline Stealer/Libraries/Vestris.ResourceLib.dll
Resource
win11-20240419-en
Behavioral task
behavioral14
Sample
Redline Stealer/Libraries/builder.exe
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
Redline Stealer/Libraries/protobuf-net.dll
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
Redline Stealer/Libraries/stub.exe
Resource
win11-20240426-en
Behavioral task
behavioral17
Sample
Redline Stealer/OpenPort.bat
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
Redline Stealer/RedLine.MainPanel-cracked.exe
Resource
win11-20240508-en
General
-
Target
Redline Stealer/RedLine.MainPanel-cracked.exe
-
Size
633KB
-
MD5
baf102927947289e4d589028620ce291
-
SHA1
5ade9a99a86e5558e5353afa7844229ed23bdcd5
-
SHA256
a6d2d1ba6765e5245b0f62e37d9298e20c913c5a33912b98bd65a76fc5ab28ae
-
SHA512
973ecb034ba18a74c85165df743d9d87168b07539c8ef1d60550171bc0a5766a10b9e6be1425aea203be45b4175694a489ea1b7837faa3b1927ca019492ccd37
-
SSDEEP
12288:JhNkz1XpXpXpXpXpXpXpXpXpXpX7t4umBNOuihNynH91xX:J22Mnynd
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
resource yara_rule behavioral18/memory/5044-1-0x0000000000300000-0x00000000003A4000-memory.dmp family_redline behavioral18/memory/5044-2-0x0000000004DA0000-0x0000000004DCA000-memory.dmp family_redline behavioral18/memory/5044-13-0x00000000052F0000-0x00000000052FE000-memory.dmp family_redline behavioral18/memory/5044-14-0x0000000005550000-0x000000000557A000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5044 RedLine.MainPanel-cracked.exe