redline

General

Target

b925ec01736fd6790a5fdaad4d3ef0a2a0a37eacd7770f0b8147b10438c7cf65
Size

147KB
Sample

221001-zp3mtagdek
MD5

1b141c3f1a9ab3f342f95164e0a3832c
SHA1

cedef6f54cdef48c4f3b73645e9cfb991df3f712
SHA256

b925ec01736fd6790a5fdaad4d3ef0a2a0a37eacd7770f0b8147b10438c7cf65
SHA512

d5bb164b8432a2d6c64fdf58d30579ed39156921234c511361caa9814beafb721c4879e45463649250af9f748318b3aab100cc5869b8b1222256e0a9b8b226b9
SSDEEP

3072:3pTtrDrGRZsehHEDJUM+wyK0Orghw7d+:3DGx2JUM+wyKii7d

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

inslab26

C2

185.182.194.25:8251

Attributes

auth_value
7c9cbd0e489a3c7fd31006406cb96f5b

Targets

- Target
  
  b925ec01736fd6790a5fdaad4d3ef0a2a0a37eacd7770f0b8147b10438c7cf65
- Size
  
  147KB
- MD5
  
  1b141c3f1a9ab3f342f95164e0a3832c
- SHA1
  
  cedef6f54cdef48c4f3b73645e9cfb991df3f712
- SHA256
  
  b925ec01736fd6790a5fdaad4d3ef0a2a0a37eacd7770f0b8147b10438c7cf65
- SHA512
  
  d5bb164b8432a2d6c64fdf58d30579ed39156921234c511361caa9814beafb721c4879e45463649250af9f748318b3aab100cc5869b8b1222256e0a9b8b226b9
- SSDEEP
  
  3072:3pTtrDrGRZsehHEDJUM+wyK0Orghw7d+:3DGx2JUM+wyKii7d
Score

10^/10

redline smokeloader inslab26 backdoor discovery infostealer spyware stealer trojan
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1