redline

General

Target

2799f011a46101e166a985dc8e134d658149e2ced40a1e53f276b82d1a72f9a5
Size

175KB
Sample

220925-ynyf2ahbcn
MD5

f0fc06ff15183775f7cca320c8eb7a2c
SHA1

529d1fbe6e83bde126446fb33e192adde928151d
SHA256

2799f011a46101e166a985dc8e134d658149e2ced40a1e53f276b82d1a72f9a5
SHA512

c24c501972358d311e090d88d94c44cabe16233768439887e8e52dab88222c31e836a92ab1e0324b6f73a61c963404891469001808681ee592bde9e63d97517a
SSDEEP

3072:7MV1U6vNBzz5OYIO86cfCzLsbfa3spaLIBHj6h9N5x:iQd6cfCzYbdpuO8

Score

10^/10

redline logsdiller cloud (tg: @mr_golds)evasion infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @mr_golds)

C2

77.73.134.27:7161

Attributes

auth_value
4b2de03af6b6ac513ac597c2e6c1ad51

Targets

- Target
  
  2799f011a46101e166a985dc8e134d658149e2ced40a1e53f276b82d1a72f9a5
- Size
  
  175KB
- MD5
  
  f0fc06ff15183775f7cca320c8eb7a2c
- SHA1
  
  529d1fbe6e83bde126446fb33e192adde928151d
- SHA256
  
  2799f011a46101e166a985dc8e134d658149e2ced40a1e53f276b82d1a72f9a5
- SHA512
  
  c24c501972358d311e090d88d94c44cabe16233768439887e8e52dab88222c31e836a92ab1e0324b6f73a61c963404891469001808681ee592bde9e63d97517a
- SSDEEP
  
  3072:7MV1U6vNBzz5OYIO86cfCzLsbfa3spaLIBHj6h9N5x:iQd6cfCzYbdpuO8
Score

10^/10

redline logsdiller cloud (tg: @mr_golds)evasion infostealer spyware stealer upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1