redline | 693c7db29495147f787046f3dffa6cdfb0ab66e078de6b9e87a5375260e9f476 | Triage

Sharing

General

Target

693c7db29495147f787046f3dffa6cdfb0ab66e078de6b9e87a5375260e9f476
Size

479KB
Sample

241111-b5jymszbqj
MD5

ca231fb0ac9a744e303c3b67f1d0b390
SHA1

87803be516dee03aed13f9c9a84066df4b9ba4b8
SHA256

693c7db29495147f787046f3dffa6cdfb0ab66e078de6b9e87a5375260e9f476
SHA512

053d32a68fea4b846d59606eb878291a697e4d6577ee7dd2e24165a23e77eb7a1b5075e2eee1fb45ed269922964ca0766f8228aede57d1d1f0f7e20c66687c15
SSDEEP

12288:lMr2y90ljlhFZK7yUzOJ3fVN9SjqiSihfLJiXj:7yiZhFZKLOJ3kjqibfV+j

Score

10^/10

redline discovery infostealer persistence

Malware Config

Targets

- Target
  
  693c7db29495147f787046f3dffa6cdfb0ab66e078de6b9e87a5375260e9f476
- Size
  
  479KB
- MD5
  
  ca231fb0ac9a744e303c3b67f1d0b390
- SHA1
  
  87803be516dee03aed13f9c9a84066df4b9ba4b8
- SHA256
  
  693c7db29495147f787046f3dffa6cdfb0ab66e078de6b9e87a5375260e9f476
- SHA512
  
  053d32a68fea4b846d59606eb878291a697e4d6577ee7dd2e24165a23e77eb7a1b5075e2eee1fb45ed269922964ca0766f8228aede57d1d1f0f7e20c66687c15
- SSDEEP
  
  12288:lMr2y90ljlhFZK7yUzOJ3fVN9SjqiSihfLJiXj:7yiZhFZKLOJ3kjqibfV+j
Score

10^/10

redline discovery infostealer persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinediscoveryinfostealerpersistence