redline

General

Target

379a6a4f7be0d0e21a5e5b996ea8aeeb.exe
Size

1.2MB
Sample

220807-jcdj6aadc8
MD5

379a6a4f7be0d0e21a5e5b996ea8aeeb
SHA1

27df283dcb89ee72f304df89d3938239acc32439
SHA256

3080f7ed1cb9ec8fbf4c0cf992bd0eb9dba5f69d0342f58ebcc8943d28c77a97
SHA512

e6705fc43877d4f46052f03dbd0a17cdc5afee7b2d6eec4f944556d005a613e9b356361ad3df9cb5164925f5429109d348a4c0b90018220047f8956d9b32f4b8

Score

10^/10

redline xmrig logsdiller cloud (sup: @mr_golds)discovery evasion exploit infostealer miner persistence spyware themida trojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

193.233.193.14:8163

Attributes

auth_value
56c6f7b9024c076f0a96931453da7e56

Targets

- Target
  
  379a6a4f7be0d0e21a5e5b996ea8aeeb.exe
- Size
  
  1.2MB
- MD5
  
  379a6a4f7be0d0e21a5e5b996ea8aeeb
- SHA1
  
  27df283dcb89ee72f304df89d3938239acc32439
- SHA256
  
  3080f7ed1cb9ec8fbf4c0cf992bd0eb9dba5f69d0342f58ebcc8943d28c77a97
- SHA512
  
  e6705fc43877d4f46052f03dbd0a17cdc5afee7b2d6eec4f944556d005a613e9b356361ad3df9cb5164925f5429109d348a4c0b90018220047f8956d9b32f4b8
Score

10^/10

redline logsdiller cloud (sup: @mr_golds)infostealer spyware xmrig discovery evasion exploit miner persistence themida trojan
- Modifies security service
  evasion
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Modifies file permissions
  discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2