redline

General

Target

Sun03ea09aa5c9686e5.exe
Size

8KB
Sample

211031-jtylnafga8
MD5

a9b1f1220f1d5b0fe97d1e88a0bad407
SHA1

d290340d1766ac2d112973bc3928a8d7531fe1d7
SHA256

9cde8e9e06dd9ce7b6e4a13e9772d6811a54b3aef023303ffcae41a85fdb33a1
SHA512

c79f13d666169ce82194bcf7aae6c5ca4d4a6444692d98642062d9eb01f2a604409ec629747dd5741cfb61236eb2fc6bb7a4e358f130db9488b2ae54c2330997

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

41.6

Botnet

933

C2

https://mas.to/@lilocc

Attributes

profile_id
933

Extracted

Family

redline

Botnet

build999

C2

185.244.181.221:33120

Targets

- Target
  
  Sun03ea09aa5c9686e5.exe
- Size
  
  8KB
- MD5
  
  a9b1f1220f1d5b0fe97d1e88a0bad407
- SHA1
  
  d290340d1766ac2d112973bc3928a8d7531fe1d7
- SHA256
  
  9cde8e9e06dd9ce7b6e4a13e9772d6811a54b3aef023303ffcae41a85fdb33a1
- SHA512
  
  c79f13d666169ce82194bcf7aae6c5ca4d4a6444692d98642062d9eb01f2a604409ec629747dd5741cfb61236eb2fc6bb7a4e358f130db9488b2ae54c2330997
Score

10^/10

redline vidar xmrig 933 build999 discovery evasion infostealer miner persistence spyware stealer themida trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Vidar Stealer
  stealer
- XMRig Miner Payload
  miner
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2