redline

General

Target

e49d676cccce4f9d919acd2e83bc9179.bin
Size

132KB
Sample

230123-l3g2dacg83
MD5

56734e24488402970159e1efcf622dd5
SHA1

0362922dd3cb5bc18e8c46a2af12c9a7d3abab1d
SHA256

2d585f1dfae193aa75db1ef0425369d74d99ff3368c251be14b2c7da9ac6c90e
SHA512

bc240ecd8c443699f0f790154e3f771f88d0c9223a5b0fcdf390fa65856819d546ff117f697436581798ec0f8f51904b33608281c95318bda87abe12ccf97bbb
SSDEEP

3072:rzkefle3HGeg+JENu3BJI2r57g/y/PRJQJF4O1VmVwG8xq:/dfle2eg9NubtJ/PRJQuV8xq

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

2.1

Botnet

237

C2

https://t.me/jetbim2

https://steamcommunity.com/profiles/76561199471266194

Attributes

profile_id
237

Extracted

Family

redline

Botnet

anydesk-usa

C2

89.163.146.82:25313

Attributes

auth_value
3048255396a3eb3d3aa36222e7cab88d

Targets

- Target
  
  a4ecbb73af38b20242d90d0fb6a7dd82371298a6ea938987f1a2b7f429dfb557.exe
- Size
  
  208KB
- MD5
  
  e49d676cccce4f9d919acd2e83bc9179
- SHA1
  
  f4974f564bd5708acad457bb0a5e989e73570d16
- SHA256
  
  a4ecbb73af38b20242d90d0fb6a7dd82371298a6ea938987f1a2b7f429dfb557
- SHA512
  
  5635a09b168c6d71509d0409886dc31be398bca1e5466889c087063772fc9cb81a2c5ab5940d51956a8fc91329c65244fb41747f44631ff3519790a2bc076b11
- SSDEEP
  
  3072:oXzTxwnu3z3B35LleBsX89oTuuM41MVWIxzOapb:8Bf3z3B1losXFtM41MHLp
Score

10^/10

smokeloader backdoor trojan redline vidar 237 anydesk-usa discovery infostealer spyware stealer
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2