RedLine Sample: 14267DA9EB76E935

RedLine 恶意软件分析

文件属性

SHA256: 14267da9eb76e935a0e22c8700ba8916d3e31b5997d2a1bc0edfe439d09f435b

MD5: b7981b3c71da88741c5be4349f691829

文件类型: exe

大小: 298,496 byte

首次发现: 2021-11-23

AV 特征: Smoke Loader

Imphash: b90a6995421b6eb79d6bcd36b44f24cf

报告者: ervindaprtma

标签: Arkei, exe, Redline, Smoke Loader, Tofsee, vidar, XMRIG

静态分析：基于元数据（未下载样本）

RedLine — 恶意软件档案

RedLine Stealer. QUOTATION lure. PCRE regex library. Form-grabbing. Credential theft.

恶意软件类型

Infostealer

编程语言

.NET C#

C2协议

HTTPS

目标系统

Windows

别名 (AKA)

RedLine Stealer

技术细节

.NET, gRPC C2 protokolu, browser credential theft (tum Chromium/Firefox tabanlılar), cryptocurrency wallet stealer, VPN credential stealer, Discord/Steam token stealer

归因 / 威胁行为者

Rusca konusulan gelistirici/operatorler; MaaS modeli ile cok sayida musteriye hizmet. 2024 Operasyon Magnus'ta birden fazla sunucu operatoru gozaltina alinmistir.

能力与行为

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

IOC列表 (1 个指标)

IOC — RedLine 复制

# FILEPATH 14267da9eb76e935a0e22c8700ba8916d3e31b5997d2a1bc0edfe439d09f435b

类型	值	备注
filepath	14267da9eb76e935a0e22c8700ba8916d3e31b5997d2a1bc0edfe439d09f435b	PDB

C2服务器 (该家族共有 8 台已记录服务器)

地址	类型	端口	协议	状态	国家
github.com	domain	—	HTTP	active	—
185.220.101.47	ip	80	HTTP	active	DE
103.224.241.163	ip	443	HTTPS	inactive	SG
45.142.212.100	ip	11821	TCP	inactive	—
193.56.255.42	ip	15000	TCP	inactive	—
5.188.87.39	ip	30000	TCP	inactive	—
46.205.202.219	ip	1912	TCP	inactive	—
217.65.2.14	ip	1912	TCP	inactive	—

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。