redline | 807d3d0819b6de19ae75c283cea664d8f8668e26992a66f152750cb4006faf59 | Triage

Sharing

General

Target

807d3d0819b6de19ae75c283cea664d8f8668e26992a66f152750cb4006faf59N.exe
Size

305KB
Sample

250208-aml5lswndn
MD5

5c24587733cc0d4f5c3678f1c0d33270
SHA1

ccbf39baf7d376cb8034835e863167b2368b598d
SHA256

807d3d0819b6de19ae75c283cea664d8f8668e26992a66f152750cb4006faf59
SHA512

811e983bfcc299e0967b7121e97fb8cbbf3f7ebf7952dc2b04cd832dfc420db9c0619084f53c1434f1ff8a34a81a5c50bba05e04fb716ee9f4e16406d812715d
SSDEEP

6144:KNy+bnr+Qp0yN90QENBc1K9QBiwyhULM/0/J/uClXItQi98e7kXuzz/K:vMrIy90nq1WQB+i/B/lYtMmK

Score

10^/10

redline muza defense_evasion discovery evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

muza

C2

185.161.248.75:4132

Attributes

auth_value
99f39e1ac98e0c0a729ab27594e72bc3

Targets

- Target
  
  807d3d0819b6de19ae75c283cea664d8f8668e26992a66f152750cb4006faf59N.exe
- Size
  
  305KB
- MD5
  
  5c24587733cc0d4f5c3678f1c0d33270
- SHA1
  
  ccbf39baf7d376cb8034835e863167b2368b598d
- SHA256
  
  807d3d0819b6de19ae75c283cea664d8f8668e26992a66f152750cb4006faf59
- SHA512
  
  811e983bfcc299e0967b7121e97fb8cbbf3f7ebf7952dc2b04cd832dfc420db9c0619084f53c1434f1ff8a34a81a5c50bba05e04fb716ee9f4e16406d812715d
- SSDEEP
  
  6144:KNy+bnr+Qp0yN90QENBc1K9QBiwyhULM/0/J/uClXItQi98e7kXuzz/K:vMrIy90nq1WQB+i/B/lYtMmK
Score

10^/10

redline muza defense_evasion discovery evasion infostealer persistence trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Downloads MZ/PE file
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

redlinemuzadefense_evasiondiscoveryevasioninfostealerpersistencetrojan