redline

General

Target

c217a27d45ffd34ab5f0ba5b492f89bbf29c9b43a1f298a169d6e30ee3621de9
Size

276KB
Sample

220526-jz58pahfg9
MD5

2ba7932ae671c6b33cf090a09a57c477
SHA1

a6429fd75cd3c336bb6ffc9bcda29cbe79089709
SHA256

c217a27d45ffd34ab5f0ba5b492f89bbf29c9b43a1f298a169d6e30ee3621de9
SHA512

35ad046ee96f9ac4badbccab6966567eb7698e4fc30661978de8afa71e5a6de6f7273e92bcb739bd256c6d660222f87710e96cb3289fabd2941123c80b00a5ec

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://bahninfo.at/upload/

http://img4mobi.com/upload/

http://equix.ru/upload/

http://worldalltv.com/upload/

http://negarehgallery.com/upload/

http://lite-server.ru/upload/

http://piratia/su/upload/

http://go-piratia.ru/upload/

rc4.i32

Extracted

Family

redline

Botnet

paladinka

C2

193.150.103.38:5473

Attributes

auth_value
dc55266997db5fa4500c1d36832ae819

Targets

- Target
  
  c217a27d45ffd34ab5f0ba5b492f89bbf29c9b43a1f298a169d6e30ee3621de9
- Size
  
  276KB
- MD5
  
  2ba7932ae671c6b33cf090a09a57c477
- SHA1
  
  a6429fd75cd3c336bb6ffc9bcda29cbe79089709
- SHA256
  
  c217a27d45ffd34ab5f0ba5b492f89bbf29c9b43a1f298a169d6e30ee3621de9
- SHA512
  
  35ad046ee96f9ac4badbccab6966567eb7698e4fc30661978de8afa71e5a6de6f7273e92bcb739bd256c6d660222f87710e96cb3289fabd2941123c80b00a5ec
Score

10^/10

redline smokeloader paladinka backdoor bootkit discovery evasion infostealer persistence spyware stealer suricata trojan upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
  suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
  suricata
- suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
  suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1