General

  • Target

    a977f111b6cfc531aaa949a1142b573fd1737d23f3a97077b69ef37433abb6b4

  • Size

    145KB

  • Sample

    221001-npsl3afhg7

  • MD5

    14f6a0b91e54b9639ab359f1964a8619

  • SHA1

    2bc241344727fdcc6f85679e625529940011bab3

  • SHA256

    a977f111b6cfc531aaa949a1142b573fd1737d23f3a97077b69ef37433abb6b4

  • SHA512

    c9bd1002a666ce121074b39eeaaa2e2fd1c401d1cc245bd226f31691a0f0c94ff6d7dc9e9465b13b26f7d90b01c06b63ef0e8bb828260a3ea24b2a0a2812fc04

Malware Config

Extracted

Family

redline

Botnet

inslab26

C2

185.182.194.25:8251

Attributes
auth_value
7c9cbd0e489a3c7fd31006406cb96f5b

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

45.154.98.214:6606

Attributes
delay
3
install
false
install_folder
%AppData%
aes.plain

Extracted

Family

redline

Botnet

1

C2

93.159.221.122:8387

Targets

    • Target

      a977f111b6cfc531aaa949a1142b573fd1737d23f3a97077b69ef37433abb6b4

    • Size

      145KB

    • MD5

      14f6a0b91e54b9639ab359f1964a8619

    • SHA1

      2bc241344727fdcc6f85679e625529940011bab3

    • SHA256

      a977f111b6cfc531aaa949a1142b573fd1737d23f3a97077b69ef37433abb6b4

    • SHA512

      c9bd1002a666ce121074b39eeaaa2e2fd1c401d1cc245bd226f31691a0f0c94ff6d7dc9e9465b13b26f7d90b01c06b63ef0e8bb828260a3ea24b2a0a2812fc04

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Detects Smokeloader packer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Async RAT payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation