redline

General

Target

2d3503d8540e319851a67e55f06ed9e5ba060e821eec6dbc83960a5947ad1310.bin
Size

128KB
Sample

220807-pdk9aaaehm
MD5

a7661b5802ed9c34ca2244e90efc83ce
SHA1

94fc10dd134800e663dca7af716e1cea0687bd02
SHA256

847e1e62de8a0e2f7e2a2024f74131bfd9ce8c81ebed2ce53e83d11516487443
SHA512

e3f19fb7518ea481f050441a868c86b90287ca256a5342beb602bfea18ba951db17866519b3a2d7d65f18a1c20839336e14134dbf30f050128e8fa3bb3bd91eb

Score

10^/10

redline xmrig logsdiller cloud (sup: @mr_golds)discovery evasion exploit infostealer miner persistence spyware stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

193.233.193.14:8163

Attributes

auth_value
56c6f7b9024c076f0a96931453da7e56

Targets

- Target
  
  2d3503d8540e319851a67e55f06ed9e5ba060e821eec6dbc83960a5947ad1310.bin
- Size
  
  128KB
- MD5
  
  a7661b5802ed9c34ca2244e90efc83ce
- SHA1
  
  94fc10dd134800e663dca7af716e1cea0687bd02
- SHA256
  
  847e1e62de8a0e2f7e2a2024f74131bfd9ce8c81ebed2ce53e83d11516487443
- SHA512
  
  e3f19fb7518ea481f050441a868c86b90287ca256a5342beb602bfea18ba951db17866519b3a2d7d65f18a1c20839336e14134dbf30f050128e8fa3bb3bd91eb
Score

10^/10

redline logsdiller cloud (sup: @mr_golds)discovery infostealer spyware stealer xmrig evasion exploit miner persistence themida trojan
- Modifies security service
  evasion
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2