redline

General

Target

eda2dcf4d4e42de0b022f2328b44663e.exe
Size

5.6MB
Sample

211201-wcwf7ahfd4
MD5

eda2dcf4d4e42de0b022f2328b44663e
SHA1

de52903d632c7820205f4dacd148ca6c3c4b2e09
SHA256

2bc97cd49318c39077f6852ef2fd0235ad8828f67fb4e35e36f355e332192383
SHA512

08fa083c56ed0e363e745b014b360c12cff2445563c9f075b44d54d67fe2964a8c5685ec9b89cf2bb7c56ff7042c2dd90ff153f86fdf12949cc1f514327dd2e1

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

48.7

Botnet

933

C2

https://mstdn.social/@anapa

https://mastodon.social/@mniami

Attributes

profile_id
933

Targets

- Target
  
  eda2dcf4d4e42de0b022f2328b44663e.exe
- Size
  
  5.6MB
- MD5
  
  eda2dcf4d4e42de0b022f2328b44663e
- SHA1
  
  de52903d632c7820205f4dacd148ca6c3c4b2e09
- SHA256
  
  2bc97cd49318c39077f6852ef2fd0235ad8828f67fb4e35e36f355e332192383
- SHA512
  
  08fa083c56ed0e363e745b014b360c12cff2445563c9f075b44d54d67fe2964a8c5685ec9b89cf2bb7c56ff7042c2dd90ff153f86fdf12949cc1f514327dd2e1
Score

10^/10

redline vidar xmrig 933 discovery infostealer miner persistence spyware stealer
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Vidar Stealer
  stealer
- XMRig Miner Payload
  miner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2