redline

General

Target

d01bb4a9683dc27bb6ba39ddc4fb0e1d61de269e1df547242a39e1ffe01edc2a
Size

195KB
Sample

230122-v8my9aae8w
MD5

392e19cc45572f9c71fc4d49c791d419
SHA1

2adbbfa040bf3fa80a8fa3f3fbe9392c7517a2e8
SHA256

d01bb4a9683dc27bb6ba39ddc4fb0e1d61de269e1df547242a39e1ffe01edc2a
SHA512

bb4ba996ea77bcb23f896cbba7e36ca88a9564ad9b740b678bd933a2536a72f14d3b4d9b2b0c90fbb67ce8468d58eebad163299d21ca70f8c74b27e7e30d3a4b
SSDEEP

3072:pBN0XCPA8rXgLIvbneX5pxoFvY5vtGsCLhcuhcTfiJWZi08:viZLWze7yFkGTLaLfikZi0

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

2.1

Botnet

237

C2

https://t.me/jetbim2

https://steamcommunity.com/profiles/76561199471266194

Attributes

profile_id
237

Extracted

Family

redline

Botnet

anydesk-usa

C2

89.163.146.82:25313

Attributes

auth_value
3048255396a3eb3d3aa36222e7cab88d

Targets

- Target
  
  d01bb4a9683dc27bb6ba39ddc4fb0e1d61de269e1df547242a39e1ffe01edc2a
- Size
  
  195KB
- MD5
  
  392e19cc45572f9c71fc4d49c791d419
- SHA1
  
  2adbbfa040bf3fa80a8fa3f3fbe9392c7517a2e8
- SHA256
  
  d01bb4a9683dc27bb6ba39ddc4fb0e1d61de269e1df547242a39e1ffe01edc2a
- SHA512
  
  bb4ba996ea77bcb23f896cbba7e36ca88a9564ad9b740b678bd933a2536a72f14d3b4d9b2b0c90fbb67ce8468d58eebad163299d21ca70f8c74b27e7e30d3a4b
- SSDEEP
  
  3072:pBN0XCPA8rXgLIvbneX5pxoFvY5vtGsCLhcuhcTfiJWZi08:viZLWze7yFkGTLaLfikZi0
Score

10^/10

redline smokeloader vidar 237 anydesk-usa backdoor discovery infostealer spyware stealer trojan
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1