redline | 701986c47ddb3f307beaaa3c0efaf92b868d982d6d16c8ba824ebfc594cfbf61 | Triage

Sharing

General

Target

701986c47ddb3f307beaaa3c0efaf92b868d982d6d16c8ba824ebfc594cfbf61
Size

231KB
Sample

221226-d23mpacd59
MD5

8d08db0e4719d3e84a6dcb92445fe19c
SHA1

a2c978f75eb23dc1000c5ecbef2f6f6c63d903c8
SHA256

701986c47ddb3f307beaaa3c0efaf92b868d982d6d16c8ba824ebfc594cfbf61
SHA512

35c0405e8bd20cb3489c4135f7dca48659142b560b6081fd224668f815b1d11b08e88480d8fbb05dfce3e9986ab6677b75856c9a1d1fb67530f98f17644bbd34
SSDEEP

3072:scnX4LU3a5GVk/nNRG4J/bpQyqW8nAOnoVlS1g/tK8uC9WwLrcSb54VIcVTuh:wLEHkP3G41bpQyG3no7tK8SCbIr

Score

10^/10

redline smokeloader 11 backdoor infostealer spyware trojan

Malware Config

Extracted

Family

redline

Botnet

11

C2

79.137.202.18:45218

Attributes

auth_value
107e09eee63158d2488feb03dac75204

Targets

- Target
  
  701986c47ddb3f307beaaa3c0efaf92b868d982d6d16c8ba824ebfc594cfbf61
- Size
  
  231KB
- MD5
  
  8d08db0e4719d3e84a6dcb92445fe19c
- SHA1
  
  a2c978f75eb23dc1000c5ecbef2f6f6c63d903c8
- SHA256
  
  701986c47ddb3f307beaaa3c0efaf92b868d982d6d16c8ba824ebfc594cfbf61
- SHA512
  
  35c0405e8bd20cb3489c4135f7dca48659142b560b6081fd224668f815b1d11b08e88480d8fbb05dfce3e9986ab6677b75856c9a1d1fb67530f98f17644bbd34
- SSDEEP
  
  3072:scnX4LU3a5GVk/nNRG4J/bpQyqW8nAOnoVlS1g/tK8uC9WwLrcSb54VIcVTuh:wLEHkP3G41bpQyG3no7tK8SCbIr
Score

10^/10

redline smokeloader 11 backdoor infostealer spyware trojan
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Credentials in Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

redlinesmokeloader11backdoorinfostealerspywaretrojan