redline | 11f8c77282f0b1c1b4362a896ed6694471751172d876b0e413897942098c21e5 | Triage

Sharing

General

Target

11f8c77282f0b1c1b4362a896ed6694471751172d876b0e413897942098c21e5
Size

232KB
Sample

221225-2e9dqafd3y
MD5

ae0bca1a3b76e8e8a894b75a83bf9b7c
SHA1

fdb9b2f3023f8e8e9693f83843419388480259f3
SHA256

11f8c77282f0b1c1b4362a896ed6694471751172d876b0e413897942098c21e5
SHA512

9bce44c357d6702695b1fecac5fa8cb2dfdeb33e4ba40d4c49c19a51498ce274b65a5c68d9f5949e1623b76af36bb4351bd6a2a3922c4e053086c2a003ecc853
SSDEEP

3072:z2eKOLMc445Q74If+cDSKajPPAORgJ37pftXMlS1g/tK8tBkuLrcSb54VIcVTuh:7LR4ZENKajPPAwgvStK8tBFbIr

Score

10^/10

redline smokeloader 11 backdoor infostealer spyware trojan

Malware Config

Extracted

Family

redline

Botnet

11

C2

79.137.202.18:45218

Attributes

auth_value
107e09eee63158d2488feb03dac75204

Targets

- Target
  
  11f8c77282f0b1c1b4362a896ed6694471751172d876b0e413897942098c21e5
- Size
  
  232KB
- MD5
  
  ae0bca1a3b76e8e8a894b75a83bf9b7c
- SHA1
  
  fdb9b2f3023f8e8e9693f83843419388480259f3
- SHA256
  
  11f8c77282f0b1c1b4362a896ed6694471751172d876b0e413897942098c21e5
- SHA512
  
  9bce44c357d6702695b1fecac5fa8cb2dfdeb33e4ba40d4c49c19a51498ce274b65a5c68d9f5949e1623b76af36bb4351bd6a2a3922c4e053086c2a003ecc853
- SSDEEP
  
  3072:z2eKOLMc445Q74If+cDSKajPPAORgJ37pftXMlS1g/tK8tBkuLrcSb54VIcVTuh:7LR4ZENKajPPAwgvStK8tBFbIr
Score

10^/10

redline smokeloader 11 backdoor infostealer spyware trojan
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Credentials in Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinesmokeloader11backdoorinfostealerspywaretrojan