redline

General

Target

452a8d5f7cab2edc1e7071ee5b336c33c43fe002033f7734d0ce8170ddf36380
Size

163KB
Sample

221117-1rw4gsbh4t
MD5

9e8f925203107e007f6f5aa0e580ca22
SHA1

6a84b8fb2cafd94bb763cbde37b15498cd042b5d
SHA256

452a8d5f7cab2edc1e7071ee5b336c33c43fe002033f7734d0ce8170ddf36380
SHA512

618eb0b2436728b9f331f1265f5e493ca166d44c5fe8decbb7d862c76a47fb1b01e7cd99219e01540367060c0b79c988d7dec79dbe25e0fe965fd92df85ccd35
SSDEEP

3072:rTr+dI/pWrUus548z9oaOpqVvqsTpfngCVG:rn4cSUq/AJg

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

5m

C2

chardhesha.xyz:81

jalocliche.xyz:81

Attributes

auth_value
7c8e8b4b3a28fd1de43f43277f38b9e3

Extracted

Family

vidar

Version

55.7

Botnet

1827

C2

https://t.me/deadftx

https://www.ultimate-guitar.com/u/smbfupkuhrgc1

Attributes

profile_id
1827

Extracted

Family

redline

Botnet

New2022

C2

185.106.92.111:2510

Attributes

auth_value
ef6fe7baf59e3191ff2f569e3bf0e2c7

Targets

- Target
  
  452a8d5f7cab2edc1e7071ee5b336c33c43fe002033f7734d0ce8170ddf36380
- Size
  
  163KB
- MD5
  
  9e8f925203107e007f6f5aa0e580ca22
- SHA1
  
  6a84b8fb2cafd94bb763cbde37b15498cd042b5d
- SHA256
  
  452a8d5f7cab2edc1e7071ee5b336c33c43fe002033f7734d0ce8170ddf36380
- SHA512
  
  618eb0b2436728b9f331f1265f5e493ca166d44c5fe8decbb7d862c76a47fb1b01e7cd99219e01540367060c0b79c988d7dec79dbe25e0fe965fd92df85ccd35
- SSDEEP
  
  3072:rTr+dI/pWrUus548z9oaOpqVvqsTpfngCVG:rn4cSUq/AJg
Score

10^/10

redline smokeloader vidar 1827 5m new2022 backdoor discovery evasion infostealer spyware stealer themida trojan
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1