redline

General

Target

3f2712bc6ef1dad5d229220704cbb298eb04cf6e061e47a546c9b43e0db12173
Size

196KB
Sample

220924-3q126acdg4
MD5

84c36e818328f085abc25a604c24b297
SHA1

f37797de467c75017007c3ea3209be1e902bacf6
SHA256

3f2712bc6ef1dad5d229220704cbb298eb04cf6e061e47a546c9b43e0db12173
SHA512

dc52bedcb01107f9872950850170bf153efbb32536c8d33ab1dac396bd6a28e7c114496bad28c9248f86489c5a038a1d1b9ee82e83d5663568f7af9c00884d0b
SSDEEP

3072:lLMMsLIBzhIN5Onb3vQU1NZWEGWHQRa2NbMdLqLBK3tYL/PkkXx:mL4hNDvQU1NsNWwRa2NQdLqEy

Score

10^/10

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @me_golds)

C2

77.73.134.27:7161

Attributes

auth_value
e136da06c7c0400f4091dab1787720ea

Targets

- Target
  
  3f2712bc6ef1dad5d229220704cbb298eb04cf6e061e47a546c9b43e0db12173
- Size
  
  196KB
- MD5
  
  84c36e818328f085abc25a604c24b297
- SHA1
  
  f37797de467c75017007c3ea3209be1e902bacf6
- SHA256
  
  3f2712bc6ef1dad5d229220704cbb298eb04cf6e061e47a546c9b43e0db12173
- SHA512
  
  dc52bedcb01107f9872950850170bf153efbb32536c8d33ab1dac396bd6a28e7c114496bad28c9248f86489c5a038a1d1b9ee82e83d5663568f7af9c00884d0b
- SSDEEP
  
  3072:lLMMsLIBzhIN5Onb3vQU1NZWEGWHQRa2NbMdLqLBK3tYL/PkkXx:mL4hNDvQU1NsNWwRa2NQdLqEy
Score

10^/10

redline smokeloader tofsee xmrig logsdiller cloud (tg: @me_golds)backdoor collection evasion infostealer miner persistence spyware trojan
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1