redline

General

Target

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27
Size

8KB
Sample

220211-c1nxgaaaa8
MD5

f4c9178895e50ad8d4cdc8c6298ed6ef
SHA1

3cd35638dcdccf62f7940da5676dfb5957251797
SHA256

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27
SHA512

f1d06872e632cb29819412c4ede205a0c3c75bdf9e17bb5784f8acfe81811a2a797bceaf55ef4802d77c1ba1dd9f4eab4d95919f83641e30ceb8fa6718a17a02

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://185.215.113.40/

http://1fdsdfsdfdsf.space/

http://2fds33rdsrsdrs.space/

http://3fds4544gfgf.space/

http://4jgfdjgdh5fds.space/

http://5gfdtktkkt44.space/

rc4.i32

Extracted

Family

vidar

Version

50.1

Botnet

754

C2

https://mastodon.online/@k1llerniax

https://koyu.space/@k1llerni2x

Attributes

profile_id
754

Targets

- Target
  
  e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27
- Size
  
  8KB
- MD5
  
  f4c9178895e50ad8d4cdc8c6298ed6ef
- SHA1
  
  3cd35638dcdccf62f7940da5676dfb5957251797
- SHA256
  
  e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27
- SHA512
  
  f1d06872e632cb29819412c4ede205a0c3c75bdf9e17bb5784f8acfe81811a2a797bceaf55ef4802d77c1ba1dd9f4eab4d95919f83641e30ceb8fa6718a17a02
Score

10^/10

redline smokeloader vidar 754 backdoor discovery infostealer spyware stealer trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2