RedLine Sample: 3DD466FFA2E70314

RedLine 恶意软件分析

文件属性

SHA256: 3dd466ffa2e7031457a79668f0bc129dd21a6ddfa77e95c8438089d63c4e5a8c

MD5: 0180e157cb9930ea356bf763647bd67d

文件类型: exe

大小: 1,001,472 byte

首次发现: 2024-09-23

AV 特征: RedLineStealer

Imphash: f34d5f2d4577ed6d9ceec516c1f5a744

报告者: malwarelabnet

标签: exe, Redline, RedLineStealer, SectopRAT

静态分析：基于元数据（未下载样本）

RedLine — 恶意软件档案

RedLine Stealer. QUOTATION lure. PCRE regex library. Form-grabbing. Credential theft.

恶意软件类型

Infostealer

编程语言

.NET C#

C2协议

HTTPS

目标系统

Windows

别名 (AKA)

RedLine Stealer

技术细节

.NET, gRPC C2 protokolu, browser credential theft (tum Chromium/Firefox tabanlılar), cryptocurrency wallet stealer, VPN credential stealer, Discord/Steam token stealer

归因 / 威胁行为者

Rusca konusulan gelistirici/operatorler; MaaS modeli ile cok sayida musteriye hizmet. 2024 Operasyon Magnus'ta birden fazla sunucu operatoru gozaltina alinmistir.

能力与行为

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

IOC列表 (1 个指标)

IOC — RedLine

# FILEPATH
3dd466ffa2e7031457a79668f0bc129dd21a6ddfa77e95c8438089d63c4e5a8c

类型	值	备注
filepath	3dd466ffa2e7031457a79668f0bc129dd21a6ddfa77e95c8438089d63c4e5a8c	PDB

RedLine — 查看完整档案 →

C2服务器 (该家族共有 8 台已记录服务器)

地址	类型	端口	协议	状态	国家
github.com	domain	—	HTTP	active	—
185.220.101.47	ip	80	HTTP	active	DE
103.224.241.163	ip	443	HTTPS	inactive	SG
45.142.212.100	ip	11821	TCP	inactive	—
193.56.255.42	ip	15000	TCP	inactive	—
5.188.87.39	ip	30000	TCP	inactive	—
46.205.202.219	ip	1912	TCP	inactive	—
217.65.2.14	ip	1912	TCP	inactive	—

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签

exeRedlineRedLineStealerSectopRAT