General
Target

SkyBlade.zip

Size

3MB

Sample

220429-wlvagsccg3

Score
10/10
MD5

bf278501d3b6620b9e407a0dfa46aff8

SHA1

8cf86b2176b5b614d4bc342ae862a2de870f9a20

SHA256

2f4436227631fbfc70b98404559985ec59119ef620bc856f127d2cf927659be0

SHA512

14457f00a10abc2c3027794f846db6ea3c3ea7423f1e0b931e0ff6a51018a4d283f4b729df37732bebdcefbfb80a92039f0add8f9f037147c7c1e46d0e18ff11

Malware Config

Extracted

Family

redline

Botnet

1

C2

65.108.5.252:43673

Attributes
auth_value
95517c2a2f56575288c35d9dfde4a6aa
Targets
Target

SkyBlade/StartGame.exe

MD5

6cc724aeb4a4b65ec4c162f88bcd251c

Filesize

3MB

Score
10/10
SHA1

1eabb1cdb279a90518654f58071674bc8db62511

SHA256

e5963aca74fd4fca8fbd1f4189cb726f4c1acffd39fe28626e8eafdf82e147a9

SHA512

e9703dd68996474eaf17fbc992e766bcac89523cfc8598d180a417bdbbed832d05e01cb5fc8907ff478bc6adc020e819297a5154ad1025c9377918f1683d0186

Tags

Signatures

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    Tags

  • RedLine Payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    Tags

    TTPs

    Query RegistryVirtualization/Sandbox Evasion
  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

  • Checks BIOS information in registry

    Description

    BIOS information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery
  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Checks whether UAC is enabled

    Tags

    TTPs

    System Information Discovery
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Tasks

                static1

                Score
                N/A