redline | fa068feb8d5b0988ddba148457fb4a3db8139fa43b82725e3d8e14a5cc34be29 | Triage

Sharing

General

Target

fa068feb8d5b0988ddba148457fb4a3db8139fa43b82725e3d8e14a5cc34be29.exe
Size

1.1MB
Sample

250207-zz95msxngy
MD5

262b0ec07fe74a40449871fb9e4985d6
SHA1

e5b31608396e9ecef689dc3b62819b6e191888dd
SHA256

fa068feb8d5b0988ddba148457fb4a3db8139fa43b82725e3d8e14a5cc34be29
SHA512

8fadd261e18d57cae1ffc9c18eeadfd2a84093cb5ff20f2708fbbae297a790f6e4ada6fbf659fd58325b770793f4cb3d75c9d6856845da17772eab5046f8d928
SSDEEP

24576:ry/z5gO9Uuw8AdvXGxew1RErjZ/F0NpTx4XqEKo5p64cfgWbbk5/aW:eb5goUuh2GkljxF0NT4aED5p6DfgAQ3

Score

10^/10

redline muza defense_evasion discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

muza

C2

185.161.248.75:4132

Attributes

auth_value
99f39e1ac98e0c0a729ab27594e72bc3

Targets

- Target
  
  fa068feb8d5b0988ddba148457fb4a3db8139fa43b82725e3d8e14a5cc34be29.exe
- Size
  
  1.1MB
- MD5
  
  262b0ec07fe74a40449871fb9e4985d6
- SHA1
  
  e5b31608396e9ecef689dc3b62819b6e191888dd
- SHA256
  
  fa068feb8d5b0988ddba148457fb4a3db8139fa43b82725e3d8e14a5cc34be29
- SHA512
  
  8fadd261e18d57cae1ffc9c18eeadfd2a84093cb5ff20f2708fbbae297a790f6e4ada6fbf659fd58325b770793f4cb3d75c9d6856845da17772eab5046f8d928
- SSDEEP
  
  24576:ry/z5gO9Uuw8AdvXGxew1RErjZ/F0NpTx4XqEKo5p64cfgWbbk5/aW:eb5goUuh2GkljxF0NT4aED5p6DfgAQ3
Score

10^/10

redline muza defense_evasion discovery evasion infostealer persistence trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Downloads MZ/PE file
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinemuzadefense_evasiondiscoveryevasioninfostealerpersistencetrojan