General

  • Target

    ae9a042dee52add23659383b1c4e0b0ef56524c1b3e6f63a1b07fc372944114c

  • Size

    317KB

  • Sample

    220927-g53zeadhaj

  • MD5

    36ffa42d5c149f256d7457ef1f4b0a59

  • SHA1

    d3215873d20c96779de046c895492d58d086217b

  • SHA256

    ae9a042dee52add23659383b1c4e0b0ef56524c1b3e6f63a1b07fc372944114c

  • SHA512

    929fa6fb0d76ff95e75732b000e6646f40b26e22584150f6c3a62f38b50f95f65661ac1545e01743c165a67e058575b3f497e0d335ba6a072d54914776377220

Malware Config

Extracted

Family

redline

Botnet

11

C2

77.73.134.27:7161

Attributes
auth_value
e6aadafed1fda7723d7655a5894828d2

Extracted

Family

redline

Botnet

inslab26

C2

185.182.194.25:8251

Attributes
auth_value
7c9cbd0e489a3c7fd31006406cb96f5b

Extracted

Family

redline

Botnet

install

C2

212.8.244.233:43690

Attributes
auth_value
cbce7277fef2185d93b8332df3940ad5

Targets

    • Target

      ae9a042dee52add23659383b1c4e0b0ef56524c1b3e6f63a1b07fc372944114c

    • Size

      317KB

    • MD5

      36ffa42d5c149f256d7457ef1f4b0a59

    • SHA1

      d3215873d20c96779de046c895492d58d086217b

    • SHA256

      ae9a042dee52add23659383b1c4e0b0ef56524c1b3e6f63a1b07fc372944114c

    • SHA512

      929fa6fb0d76ff95e75732b000e6646f40b26e22584150f6c3a62f38b50f95f65661ac1545e01743c165a67e058575b3f497e0d335ba6a072d54914776377220

    • Detects Smokeloader packer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation