redline

General

Target

8f1c3ffe23eb3c0a9d70c443e75285154a3d032c2e7a0f93022fe4668a4af3d5
Size

3.4MB
Sample

220312-kp8fqsaec9
MD5

941192a8c4313e19bf69897de6aaa34b
SHA1

54f566f24c8f9976e18326ab413b090b8418ad22
SHA256

8f1c3ffe23eb3c0a9d70c443e75285154a3d032c2e7a0f93022fe4668a4af3d5
SHA512

055975c588efdde791f1fe0fcc3e79661c62914203eedf818b73d1dfbda536dabc16303094eae64c365fb768b592a657230fbbf5ee65969117b3e50bccdfd83c

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.fddnice.pw/

http://www.sokoinfo.pw/

http://www.zzhlike.pw/

http://www.wygexde.xyz/

Extracted

Family

smokeloader

Version

2020

C2

http://al-commandoz.com/upload/

http://antalya-belek.com/upload/

http://luxurysv.com/upload/

http://massagespijkenisse.com/upload/

http://rexgorellhondaevent.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

BBCbrow

C2

zubelyev.xyz:80

Extracted

Family

redline

Botnet

v1

C2

199.195.251.96:43073

Targets

- Target
  
  8f1c3ffe23eb3c0a9d70c443e75285154a3d032c2e7a0f93022fe4668a4af3d5
- Size
  
  3.4MB
- MD5
  
  941192a8c4313e19bf69897de6aaa34b
- SHA1
  
  54f566f24c8f9976e18326ab413b090b8418ad22
- SHA256
  
  8f1c3ffe23eb3c0a9d70c443e75285154a3d032c2e7a0f93022fe4668a4af3d5
- SHA512
  
  055975c588efdde791f1fe0fcc3e79661c62914203eedf818b73d1dfbda536dabc16303094eae64c365fb768b592a657230fbbf5ee65969117b3e50bccdfd83c
Score

10^/10

redline smokeloader socelars bbcbrow v1 backdoor discovery evasion infostealer persistence spyware stealer trojan upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2