redline

General

Target

AdobePhotoshop2022.rar
Size

11.1MB
Sample

221005-1dgfwaffh8
MD5

cb7ef5d6b1f0aeed9ec94aed49f4d404
SHA1

2a129fca506eb7f6b3f66c0c83311e20b8b25405
SHA256

a81bff716aac89f34ef6019499d8cca004d7cc8842e45fe2a5e2247914f4446e
SHA512

af78d44ff0f9ccf6d8851ac9d672f5a3d34924092520d0d9e9427b23353c0043812f99e50848d079e06c97b9a170737605485a1efe005c2d183a4f2f4aa76009
SSDEEP

196608:RXGeo0+asauBgq2CSVENBiUOYsGn+eMwlCSaLj6USN49rkbG41:R2B0aajq27+iUXsNE0Lj6FOrW1

Score

10^/10

Malware Config

Extracted

Family

redline

C2

62.204.41.141:24758

Attributes

auth_value
5fd9f427cc50e36a33ac9b7b64720bdf

Targets

- Target
  
  Setup.js
- Size
  
  526B
- MD5
  
  be5a918f56f1ac09371c413f4344f10c
- SHA1
  
  ee20e8e7c2a1c9986d84048edd20994a91107a78
- SHA256
  
  1c498f828dc9f638623a0d5bc9db8681ba542844c07e6509255425851aa9e2ec
- SHA512
  
  8678544d627a5ce8dd9538a3813776430a817f2d13f69fbb52a9e0165e9a262970a78e80b6ff1619e495c888048a6af160ab58ab7686dc60c5ff3f4fe6bde2bf
Score

10^/10

redline xmrig infostealer miner persistence spyware stealer upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  sеttings.dll
- Size
  
  17.7MB
- MD5
  
  64dd29061c22f22c91ac3d7eea1525c4
- SHA1
  
  bd4cf8098fe5465ed1c6c8bb67a1b2eab3e6a2b0
- SHA256
  
  3e6cd274d2ce62d874271d93b2db01a5d213478fd4cccf8008b60e5f29be9ea4
- SHA512
  
  9ba2718edeeb37c4880fe99d9bf7f37c42ced31698f3d65d9340de98d766e134f99884c19e650ae00d8f7768682b12aa5254bc23134837a27fe9fad440dd841f
- SSDEEP
  
  393216:zXnTO0a6lHZq5C0a1c8ZuP+afOJ/TF2wrr:7ny0a6J9pnm/KAwH
Score

1^/10
behavioral3 behavioral4