redline

General

Target

220131-tqbb3al1qz_pw_infected.zip
Size

6.7MB
Sample

220201-y2rkmsbeg3
MD5

98f15a4e5a595c31af6f30cb472e8c5e
SHA1

370fc77d73b75b51ae4ee9e860cf097864c7fdde
SHA256

62fe0d20b451de5c3233c96364b4162386fcbfd555cd9fd099fa347c8e61fdfc
SHA512

79e285f180140ed12e069aa683649c02bd9aeecd9ab7754db493b6b4361de27fae36e72217b14bc066dc3759abeb58afc2fb20abaa36753af60c4b3d68e0397a

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

Extracted

Family

redline

Botnet

she

C2

135.181.129.119:4805

Extracted

Family

redline

Botnet

media14

C2

91.121.67.60:2151

Extracted

Family

redline

Botnet

ANI

C2

194.104.136.5:46013

Targets

- Target
  
  02ca2b5bb774890c50950ad93becc2851bac8d04c35464dad4854088c5db4135
- Size
  
  6.8MB
- MD5
  
  dcd0d8a4e476db4602f3beae6a60b4c9
- SHA1
  
  7906d0674d60685b06289db375eacf954e3185e3
- SHA256
  
  02ca2b5bb774890c50950ad93becc2851bac8d04c35464dad4854088c5db4135
- SHA512
  
  62301111141dcc72862dde4d277b4250c25bb7532105348bbb51e8ca30ded5c985016a61978509c271210faf50cbe5d789ce5f6de84511167b2c5131e8041bd8
Score

10^/10

redline socelars ani media14 she aspackv2 evasion infostealer spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1