redline

General

Target

a2ff7409a7a9f8fa78c81faea26d2ff3470896828ce8132efa8bce8cfa9f27be
Size

2.3MB
Sample

220613-xyjvysabhq
MD5

a60628f8ac9b4b589aa9eb171978611d
SHA1

3c37a5ccf17f27106d0e09c3b27f8e3355ba62e5
SHA256

a2ff7409a7a9f8fa78c81faea26d2ff3470896828ce8132efa8bce8cfa9f27be
SHA512

42dc0c10df954429bcef64022249eccb7024581c4327e0707dda61b51b6ffbc930c7f0bea74794d14a7c6434a8ade122d588d716312fe9b559f41b7f04448d64

Score

10^/10

redline xmrig logsdiller cloud (telegram: @mr_golds)discovery evasion exploit infostealer miner spyware suricata themida trojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @mr_golds)

C2

109.107.183.214:9303

Attributes

auth_value
d72163e211dc5f86585328318a5a5a13

Targets

- Target
  
  a2ff7409a7a9f8fa78c81faea26d2ff3470896828ce8132efa8bce8cfa9f27be
- Size
  
  2.3MB
- MD5
  
  a60628f8ac9b4b589aa9eb171978611d
- SHA1
  
  3c37a5ccf17f27106d0e09c3b27f8e3355ba62e5
- SHA256
  
  a2ff7409a7a9f8fa78c81faea26d2ff3470896828ce8132efa8bce8cfa9f27be
- SHA512
  
  42dc0c10df954429bcef64022249eccb7024581c4327e0707dda61b51b6ffbc930c7f0bea74794d14a7c6434a8ade122d588d716312fe9b559f41b7f04448d64
Score

10^/10

redline xmrig logsdiller cloud (telegram: @mr_golds)discovery evasion exploit infostealer miner spyware suricata themida trojan
- Modifies security service
  evasion
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
  suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
  suricata
- suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
  suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
  suricata
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner Payload
  miner
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Modifies file permissions
  discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1