redline

General

Target

54549e05d785caa3a31a8f6727ab6a1f4e6d0158a775a3f50bb779206643f235
Size

194KB
Sample

230122-yssfksbe9w
MD5

fddbbd43f4e16a816c93ba39ecda4a82
SHA1

558dae1324673d06ee9a9e2e887872cd991c6aa9
SHA256

54549e05d785caa3a31a8f6727ab6a1f4e6d0158a775a3f50bb779206643f235
SHA512

a2ddd9f0ad7e0406cfbe1f8a3d890c037af1d7794d9b9af8fef183af35442644aa303b80b8a08b3e39d23f8a5616f756369836b645780456250856b3fcf933eb
SSDEEP

3072:rBN0XfvQDFLXASeZ5ecEUkfjS3NnGxYKc8m74Xu6AHR:ViQLXxetDGTcoXu6A

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

2.1

Botnet

237

C2

https://t.me/jetbim2

https://steamcommunity.com/profiles/76561199471266194

Attributes

profile_id
237

Extracted

Family

redline

Botnet

anydesk-usa

C2

89.163.146.82:25313

Attributes

auth_value
3048255396a3eb3d3aa36222e7cab88d

Targets

- Target
  
  54549e05d785caa3a31a8f6727ab6a1f4e6d0158a775a3f50bb779206643f235
- Size
  
  194KB
- MD5
  
  fddbbd43f4e16a816c93ba39ecda4a82
- SHA1
  
  558dae1324673d06ee9a9e2e887872cd991c6aa9
- SHA256
  
  54549e05d785caa3a31a8f6727ab6a1f4e6d0158a775a3f50bb779206643f235
- SHA512
  
  a2ddd9f0ad7e0406cfbe1f8a3d890c037af1d7794d9b9af8fef183af35442644aa303b80b8a08b3e39d23f8a5616f756369836b645780456250856b3fcf933eb
- SSDEEP
  
  3072:rBN0XfvQDFLXASeZ5ecEUkfjS3NnGxYKc8m74Xu6AHR:ViQLXxetDGTcoXu6A
Score

10^/10

redline smokeloader vidar 237 anydesk-usa backdoor discovery infostealer spyware stealer trojan
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1