RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

SmokeLoader

Modular backdoor trojan in use since 2014.

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND

Grants admin privileges

Uses net.exe to modify the user's privileges.

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies RDP port number used by Windows

Modifies Windows Firewall

Sets DLL path for service in the registry

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.