redline | 36e2b88a86faa8857f637297dc068b20049dc460ef78555e2351ba8d609f65d8

General

Target
2026-08-08_cf33fc84d13a1cbec71a6fe49cd65cb5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
Size 390KB
Sample260808-rhh1tsyanh
SHA256 36e2b88a86faa8857f637297dc068b20049dc460ef78555e2351ba8d609f65d8
MD5 cf33fc84d13a1cbec71a6fe49cd65cb5
SHA1 3c76219ec644abb5b7df896b02281420ca4e2035
SHA512 6fa2de09feb8d017195c2c3c43486767251fafa8ae97521ab470c73ab9f08ff9aeeed1cedf83b45ca2adc501eaa3a97e1110d1a8ecef3b0530d81643027d7b2d
SSDEEP 6144:39wDRbzZBD1YzP8epoPWQ3WavuniycertoFT/K/+yX6Niw0T:3hzP8monGLnF2BYXo0
TLSH
T18684F1D17EA0C4F2C44A00304825D6B06AFEB9A11B7889C777A4DBFE2F343D16A7D255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

SEOFIX2

C2

utlmy.xyz:80
zahalode.xyz:80

Targets

- Target
  2026-08-08_cf33fc84d13a1cbec71a6fe49cd65cb5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 390KB
- SHA256 36e2b88a86faa8857f637297dc068b20049dc460ef78555e2351ba8d609f65d8
- MD5 cf33fc84d13a1cbec71a6fe49cd65cb5
- SHA1 3c76219ec644abb5b7df896b02281420ca4e2035
- SHA512 6fa2de09feb8d017195c2c3c43486767251fafa8ae97521ab470c73ab9f08ff9aeeed1cedf83b45ca2adc501eaa3a97e1110d1a8ecef3b0530d81643027d7b2d
- SSDEEP 6144:39wDRbzZBD1YzP8epoPWQ3WavuniycertoFT/K/+yX6Niw0T:3hzP8monGLnF2BYXo0
- TLSH
  T18684F1D17EA0C4F2C44A00304825D6B06AFEB9A11B7889C777A4DBFE2F343D16A7D255
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

seofix2 discovery redline infostealer
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing credit card regular expressions
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: RedLine

RedLine payload

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables referencing credit card regular expressions

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2