Overview

overview

10

Static

static

file.exe

windows7-x64

8

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    414KB

  • Sample

    221018-vn4q9sggem

  • MD5

    edf2eb69c5fff1cd47ae25c59695d040

  • SHA1

    442d45adc9d967c1ac84d72697d3e6fdc183c3d1

  • SHA256

    e5eb694f24982ff71260946f290e225f129201d7839b90831f3d1b7d31254df6

  • SHA512

    9b85afaf2dea1ba3b2dcea5069cb8e9a4b6e433c054154aa0f225cb83b6f350e5d3cc23955fab4b28ec364a2397f5d71200219f540aaaf9229f9a38a8f045216

  • SSDEEP

    1536:a/rae78zjORCDGwfdCSog01313Hys5go4T:mahKyd2n313b5j2

Score
10/10
redlinesmokeloadernighbackdoorcollectiondiscoveryinfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

Nigh

C2

80.66.87.20:80

Attributes
  • auth_value

    dab8506635d1dc134af4ebaedf4404eb

Targets

    • Target

      file.exe

    • Size

      414KB

    • MD5

      edf2eb69c5fff1cd47ae25c59695d040

    • SHA1

      442d45adc9d967c1ac84d72697d3e6fdc183c3d1

    • SHA256

      e5eb694f24982ff71260946f290e225f129201d7839b90831f3d1b7d31254df6

    • SHA512

      9b85afaf2dea1ba3b2dcea5069cb8e9a4b6e433c054154aa0f225cb83b6f350e5d3cc23955fab4b28ec364a2397f5d71200219f540aaaf9229f9a38a8f045216

    • SSDEEP

      1536:a/rae78zjORCDGwfdCSog01313Hys5go4T:mahKyd2n313b5j2

    Score
    10/10
    persistenceredlinesmokeloadernighbackdoorcollectiondiscoveryinfostealerspywarestealertrojan

    • Detects Smokeloader packer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks