redline

General

Target

a8ca391420619d51b69cdecd69de91f7.exe
Size

8.0MB
Sample

221006-lhlttsgha7
MD5

a8ca391420619d51b69cdecd69de91f7
SHA1

df53d79107c81f47f9244bd81f06d526bf6575ea
SHA256

669e1697823eb434f2004523e648735a41ec9044e3ca8a34a055268e0ffaf45b
SHA512

8ad3ce8701f19a9bbaa84fadd25b2b314772114b4f9635f59f4112e79fa27fdd9b24a392e8a7aa215fbfee57d4013522c7ac71af2b53be94d0977ae499a17e86
SSDEEP

196608:4JNLHNhcPQJ/HmZfovBFRuICGJrbJy3PoypzYS34dZ67YgqgP8:mHJOJirRubG9M/pYS34dZePE

Score

10^/10

Malware Config

Extracted

Family

redline

C2

185.215.113.69:15544

Attributes

auth_value
1372cd9fae57c6645ea8737ff631eb3c

Targets

- Target
  
  a8ca391420619d51b69cdecd69de91f7.exe
- Size
  
  8.0MB
- MD5
  
  a8ca391420619d51b69cdecd69de91f7
- SHA1
  
  df53d79107c81f47f9244bd81f06d526bf6575ea
- SHA256
  
  669e1697823eb434f2004523e648735a41ec9044e3ca8a34a055268e0ffaf45b
- SHA512
  
  8ad3ce8701f19a9bbaa84fadd25b2b314772114b4f9635f59f4112e79fa27fdd9b24a392e8a7aa215fbfee57d4013522c7ac71af2b53be94d0977ae499a17e86
- SSDEEP
  
  196608:4JNLHNhcPQJ/HmZfovBFRuICGJrbJy3PoypzYS34dZ67YgqgP8:mHJOJirRubG9M/pYS34dZePE
Score

10^/10

redline xmrig evasion infostealer miner spyware themida trojan upx vmprotect
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner payload
  miner
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2