redline

General

Target

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a
Size

3.2MB
Sample

220312-gprw7sbfcn
MD5

1d803235e19095cb252cb3e0bb5c8756
SHA1

706ba4dcb4696b91a762cbadcd70da0076346f74
SHA256

98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a
SHA512

a8ef75d034443469170df8f54ba5797340e50a07b8fe62bab42c39639f6b85383430fede1af6ca6241c29efce351348c3372401419e2a3fb5db3a6f93cf167ca

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

Ani

C2

yaklalau.xyz:80

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32

Targets

- Target
  
  98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a
- Size
  
  3.2MB
- MD5
  
  1d803235e19095cb252cb3e0bb5c8756
- SHA1
  
  706ba4dcb4696b91a762cbadcd70da0076346f74
- SHA256
  
  98d1fc9e02a99bbc88374d0c79e94505d155b78c7ab488ee96b9605611fda84a
- SHA512
  
  a8ef75d034443469170df8f54ba5797340e50a07b8fe62bab42c39639f6b85383430fede1af6ca6241c29efce351348c3372401419e2a3fb5db3a6f93cf167ca
Score

10^/10

aspackv2 upx redline smokeloader vidar 706 ani backdoor evasion infostealer persistence spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies AppInit DLL entries
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2