RedLine Malware Analizi

Dosya Ozellikleri

SHA256: caf61ea2c61f7911afa17eee7e22dc2164f0c154a016040ec885a9ec5c7902b4

MD5: 5edfeb63571d6700ddf3d715777a8976

Dosya Tipi: zip

Boyut: 3,144,986 byte

Ilk Gorulme: 2020-10-01

AV Imzasi: RedLine

Raporlayan: vm001cn

Etiketler: Redline

Statik analiz: metadata tabanli (ornek indirilmedi)

RedLine — Profil du malware

RedLine Stealer. QUOTATION lure. PCRE regex library. Form-grabbing. Credential theft.

Type de malware
Infostealer
Langage de programmation
.NET C#
Protocole C2
HTTPS
Systèmes ciblés
Windows
Aussi connu sous (AKA)
RedLine Stealer

Détails techniques

.NET, gRPC C2 protokolu, browser credential theft (tum Chromium/Firefox tabanlılar), cryptocurrency wallet stealer, VPN credential stealer, Discord/Steam token stealer

Attribution / Acteur de la menace

Rusca konusulan gelistirici/operatorler; MaaS modeli ile cok sayida musteriye hizmet. 2024 Operasyon Magnus'ta birden fazla sunucu operatoru gozaltina alinmistir.

Capacités et comportement

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

Liste IOC (1 indicateurs)

IOC — RedLine
# FILEPATH caf61ea2c61f7911afa17eee7e22dc2164f0c154a016040ec885a9ec5c7902b4
TypeValeurNote
filepath caf61ea2c61f7911afa17eee7e22dc2164f0c154a016040ec885a9ec5c7902b4 PDB
RedLine — Voir le profil complet →

Serveurs C2 (8 serveurs enregistrés pour cette famille)

Adresse Type Port Protocole Statut Pays
github.com domain — HTTP active —
185.220.101.47 ip 80 HTTP active DE
103.224.241.163 ip 443 HTTPS inactive SG
45.142.212.100 ip 11821 TCP inactive —
193.56.255.42 ip 15000 TCP inactive —
5.188.87.39 ip 30000 TCP inactive —
46.205.202.219 ip 1912 TCP inactive —
217.65.2.14 ip 1912 TCP inactive —

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.

Tags
Redline