redline

General

Target

d446638e0c33cac500a0ad1ffb6a864e810de514b91e1a3918fe8d6df68dbb32.exe
Size

371KB
Sample

221113-tr34gabf94
MD5

1478f2913021fbe3d058d7b3f8deafb8
SHA1

9022fdfa23e138007f4c619ac694d66c4ad9fdce
SHA256

d446638e0c33cac500a0ad1ffb6a864e810de514b91e1a3918fe8d6df68dbb32
SHA512

472ef1616e6a802f653bd8d331e99000a99a008ef984a67742de726f2ce5696475223625379334dcecfaa747b718d77fa31601637674ed76775a653fb9c07220
SSDEEP

6144:RVW5FRdL1G2Qq+4O4uvk/FmoWXmPrTkkXwOu1ql:RVKBpG2T/jNwXmPrTkkUql

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

Google2

C2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Targets

- Target
  
  d446638e0c33cac500a0ad1ffb6a864e810de514b91e1a3918fe8d6df68dbb32.exe
- Size
  
  371KB
- MD5
  
  1478f2913021fbe3d058d7b3f8deafb8
- SHA1
  
  9022fdfa23e138007f4c619ac694d66c4ad9fdce
- SHA256
  
  d446638e0c33cac500a0ad1ffb6a864e810de514b91e1a3918fe8d6df68dbb32
- SHA512
  
  472ef1616e6a802f653bd8d331e99000a99a008ef984a67742de726f2ce5696475223625379334dcecfaa747b718d77fa31601637674ed76775a653fb9c07220
- SSDEEP
  
  6144:RVW5FRdL1G2Qq+4O4uvk/FmoWXmPrTkkXwOu1ql:RVKBpG2T/jNwXmPrTkkUql
Score

10^/10

smokeloader backdoor trojan redline google2 discovery evasion exploit infostealer persistence themida
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2