redline

General

Target

7A6C8CE1E4A64866A8E1341F135544AEB2B7CA4B27D78.exe
Size

7.3MB
Sample

210520-zc8f43bg76
MD5

925852828704fb5328b96342fb6ac8bf
SHA1

32cb9126f5d990ffcb7f410418f2521f4dad33f3
SHA256

7a6c8ce1e4a64866a8e1341f135544aeb2b7ca4b27d784885dc75df7a96e56f8
SHA512

5202d91be53bcaebbb2b8b608cd9a843253d1c5b26937910546b3f72ce3807c975e7dd36ba51bf9231da4135544d9f373d04a4e73c41071353bf883bfef57dd7

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

fullynew

C2

rlmushahel.xyz:80

Extracted

Family

vidar

Version

38.3

Botnet

827

C2

https://api.faceit.com/core/v1/nicknames/vyh62lapin

Attributes

profile_id
827

Targets

- Target
  
  7A6C8CE1E4A64866A8E1341F135544AEB2B7CA4B27D78.exe
- Size
  
  7.3MB
- MD5
  
  925852828704fb5328b96342fb6ac8bf
- SHA1
  
  32cb9126f5d990ffcb7f410418f2521f4dad33f3
- SHA256
  
  7a6c8ce1e4a64866a8e1341f135544aeb2b7ca4b27d784885dc75df7a96e56f8
- SHA512
  
  5202d91be53bcaebbb2b8b608cd9a843253d1c5b26937910546b3f72ce3807c975e7dd36ba51bf9231da4135544d9f373d04a4e73c41071353bf883bfef57dd7
Score

10^/10

redline fullynew agilenet discovery infostealer persistence upx vmprotect vidar 827 evasion spyware stealer trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Vidar Stealer
  stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- autoit_exe
  AutoIT scripts compiled to PE executables.
behavioral1 behavioral2