redline

General

Target

46cfb48234ce6c52b9f361cfc5782539c337fd6e883287f9817d55eaa9363ec2
Size

3.6MB
Sample

220310-1jq79sbgg6
MD5

5507b6a058d6b102dc4ce75d0556da95
SHA1

4bbd23bb7c162ba8c78f6c9b68af2eb8fb93171e
SHA256

46cfb48234ce6c52b9f361cfc5782539c337fd6e883287f9817d55eaa9363ec2
SHA512

1d15934afed3b5f9674ec6c23baa09016c2b4874cc30a459b06a71e52c62024f3dcd022f772946ca02441ea3a1e51ea834d9b84b4274511e990c5f16ea1b8eb7

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Extracted

Family

redline

Botnet

ANINEWONE

C2

zisiarenal.xyz:80

Extracted

Family

redline

Botnet

dadad123

C2

86.107.197.196:63065

Attributes

auth_value
dd4834614a3ac04a7b90791c224626a2

Extracted

Family

vidar

Version

39.9

Botnet

706

C2

https://prophefliloc.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Targets

- Target
  
  46cfb48234ce6c52b9f361cfc5782539c337fd6e883287f9817d55eaa9363ec2
- Size
  
  3.6MB
- MD5
  
  5507b6a058d6b102dc4ce75d0556da95
- SHA1
  
  4bbd23bb7c162ba8c78f6c9b68af2eb8fb93171e
- SHA256
  
  46cfb48234ce6c52b9f361cfc5782539c337fd6e883287f9817d55eaa9363ec2
- SHA512
  
  1d15934afed3b5f9674ec6c23baa09016c2b4874cc30a459b06a71e52c62024f3dcd022f772946ca02441ea3a1e51ea834d9b84b4274511e990c5f16ea1b8eb7
Score

10^/10

redline socelars aninewone dadad123 aspackv2 evasion infostealer spyware stealer trojan smokeloader vidar 706 backdoor upx
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2