redline

General

Target

96c2ef023febbd4e3773bbb3a59e54c3.exe
Size

417KB
Sample

210926-2jsxjafcgn
MD5

96c2ef023febbd4e3773bbb3a59e54c3
SHA1

8e20dc3097d3380f1b2c567a05b3a7d8dae713bf
SHA256

770e6bbe4c4f4e7abfbb4a533d28f8e44c5a374aa05dc3c333d7f15594e217e7
SHA512

f5e45c4c6f09c1d1d40832b1611fbff8ba822964cdb40e397254ae143a44f8c822ca7b5dcbdd7a3ddbd5f1b383fd7c1db2233ac9301fbc58f3c75f280abb9370

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

7W06ZPHY

C2

188.34.176.164:80

Targets

- Target
  
  96c2ef023febbd4e3773bbb3a59e54c3.exe
- Size
  
  417KB
- MD5
  
  96c2ef023febbd4e3773bbb3a59e54c3
- SHA1
  
  8e20dc3097d3380f1b2c567a05b3a7d8dae713bf
- SHA256
  
  770e6bbe4c4f4e7abfbb4a533d28f8e44c5a374aa05dc3c333d7f15594e217e7
- SHA512
  
  f5e45c4c6f09c1d1d40832b1611fbff8ba822964cdb40e397254ae143a44f8c822ca7b5dcbdd7a3ddbd5f1b383fd7c1db2233ac9301fbc58f3c75f280abb9370
Score

10^/10

redline 7w06zphy discovery evasion infostealer persistence spyware stealer suricata
- Modifies security service
  evasion
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateProcessExOtherParentProcess
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2