redline

General

Target

58dd74be00f9f4aee71592466446b7664ea57418eda8eb643e1400bf2518a45f
Size

137KB
Sample

221001-jjy5fafff6
MD5

adf162028e5b01840010d1a79ae6bdf1
SHA1

9ce0e40ae78fa71ab43f4e8acf2d855b0ea7ebcd
SHA256

58dd74be00f9f4aee71592466446b7664ea57418eda8eb643e1400bf2518a45f
SHA512

30e27bd75a588b03f086a93d5f4d759a386b043c30caeddbb226921bb8ce3392334c9d4e901f6662e6307702ffe7ca5d79724645e80819f64b3a0a9641946fa0
SSDEEP

3072:VYO/ZMTFlxUI5rUdiKSk42oxKaVgDF0pRXqh1SS4i:VYMZMBlxUI6f42oxKV2Bqh

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

LUPEFOX

C2

o0l0j0jo.webredirect.org:28532

Attributes

auth_value
90194e50cef153fc9816a29fd46b6637

Extracted

Family

remcos

Botnet

Firefox

C2

elew3le3lanle.freeddns.org:20309

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Firefox
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Z26APQ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Firefox
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  58dd74be00f9f4aee71592466446b7664ea57418eda8eb643e1400bf2518a45f
- Size
  
  137KB
- MD5
  
  adf162028e5b01840010d1a79ae6bdf1
- SHA1
  
  9ce0e40ae78fa71ab43f4e8acf2d855b0ea7ebcd
- SHA256
  
  58dd74be00f9f4aee71592466446b7664ea57418eda8eb643e1400bf2518a45f
- SHA512
  
  30e27bd75a588b03f086a93d5f4d759a386b043c30caeddbb226921bb8ce3392334c9d4e901f6662e6307702ffe7ca5d79724645e80819f64b3a0a9641946fa0
- SSDEEP
  
  3072:VYO/ZMTFlxUI5rUdiKSk42oxKaVgDF0pRXqh1SS4i:VYMZMBlxUI6f42oxKV2Bqh
Score

10^/10

redline remcos firefox lupefox collection discovery infostealer persistence rat spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1