redline | c0a2bc18c3becdd074d641eb1146fe1924a19e383cc7409eeb99e25a40d0a05e | Triage

Sharing

General

Target

c0a2bc18c3becdd074d641eb1146fe1924a19e383cc7409eeb99e25a40d0a05e
Size

480KB
Sample

241111-cvsy8szhkm
MD5

9504f4bb4bf8b98255f798fb51faabc0
SHA1

23b4e0c32af7be447424283a35e37659b82f2d1c
SHA256

c0a2bc18c3becdd074d641eb1146fe1924a19e383cc7409eeb99e25a40d0a05e
SHA512

5a6dfa622447d4ee328ae7fe9643f37a0074646016b25682adc9b5275a4e9dbbe1367c798fe4f96badc4a06b23d300c01d192a51f4731d4d1f4a62d40a973ee4
SSDEEP

12288:VMr1y90HCa27TFiqZY4wfFoIpZd4pn1clHrb:Ay57fF7ZYDoqYpn1clHH

Score

10^/10

redline discovery infostealer persistence

Malware Config

Targets

- Target
  
  c0a2bc18c3becdd074d641eb1146fe1924a19e383cc7409eeb99e25a40d0a05e
- Size
  
  480KB
- MD5
  
  9504f4bb4bf8b98255f798fb51faabc0
- SHA1
  
  23b4e0c32af7be447424283a35e37659b82f2d1c
- SHA256
  
  c0a2bc18c3becdd074d641eb1146fe1924a19e383cc7409eeb99e25a40d0a05e
- SHA512
  
  5a6dfa622447d4ee328ae7fe9643f37a0074646016b25682adc9b5275a4e9dbbe1367c798fe4f96badc4a06b23d300c01d192a51f4731d4d1f4a62d40a973ee4
- SSDEEP
  
  12288:VMr1y90HCa27TFiqZY4wfFoIpZd4pn1clHrb:Ay57fF7ZYDoqYpn1clHH
Score

10^/10

redline discovery infostealer persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinediscoveryinfostealerpersistence