redline

General

Target

ustwo_20210607-133958
Size

120KB
Sample

210607-f1wzp3ha3a
MD5

bc3443ee6ebeac5b40d789367a61cc36
SHA1

3aca0e6d34866853b9ed702d76e0222952451eb4
SHA256

875f42b4ae4e80050231b14e50770f8e51a7b1f9887504ab6699860c9d37d09c
SHA512

bb2450f210eb7ab34a51c91b28edbfb671570d47a9c8033fd74dc1437c2e99107e4052a8a6a911b6ccf5d29fa206bb173064a83ea47cddd83819079260430240

Score

10^/10

redline servhelper n6 backdoor discovery exploit infostealer persistence spyware stealer trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

redline

Botnet

N6

C2

lyanannaron.xyz:80

Targets

- Target
  
  ustwo_20210607-133958
- Size
  
  120KB
- MD5
  
  bc3443ee6ebeac5b40d789367a61cc36
- SHA1
  
  3aca0e6d34866853b9ed702d76e0222952451eb4
- SHA256
  
  875f42b4ae4e80050231b14e50770f8e51a7b1f9887504ab6699860c9d37d09c
- SHA512
  
  bb2450f210eb7ab34a51c91b28edbfb671570d47a9c8033fd74dc1437c2e99107e4052a8a6a911b6ccf5d29fa206bb173064a83ea47cddd83819079260430240
Score

10^/10

redline servhelper n6 backdoor discovery exploit infostealer persistence spyware stealer trojan upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- ServHelper
  ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
  trojan backdoor servhelper
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Sets DLL path for service in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2