redline

General

Target

5bc665f31bf0ab4cd1b1ce6da5e44487d1ad0dfed5d1495d18f4a7a25edabddb
Size

326KB
Sample

230123-m685psef4w
MD5

137c1fa3e9697e003c7381790ea43c8a
SHA1

4df13dfbca12db22bca275489384745f167b3dc6
SHA256

5bc665f31bf0ab4cd1b1ce6da5e44487d1ad0dfed5d1495d18f4a7a25edabddb
SHA512

6a0f8e42d292ef4eed28e1fb7e3b3d5cd3dc372327282e09aeaa54b0657e048a781fd77d1f478ebb930c9445659cb9bfcea6513fc5769b0318d924c9aa247bb7
SSDEEP

6144:JJLRK58XT9kE2LlKv0Ph3wc80wtQK/fu1d0UWmTb:JJNKmZ7I18XtQKXu1PW

Score

10^/10

Malware Config

Extracted

Family

vidar

Version

2.1

Botnet

237

C2

https://t.me/jetbim2

https://steamcommunity.com/profiles/76561199471266194

Attributes

profile_id
237

Extracted

Family

redline

Botnet

anydesk-usa

C2

89.163.146.82:25313

Attributes

auth_value
3048255396a3eb3d3aa36222e7cab88d

Targets

- Target
  
  5bc665f31bf0ab4cd1b1ce6da5e44487d1ad0dfed5d1495d18f4a7a25edabddb
- Size
  
  326KB
- MD5
  
  137c1fa3e9697e003c7381790ea43c8a
- SHA1
  
  4df13dfbca12db22bca275489384745f167b3dc6
- SHA256
  
  5bc665f31bf0ab4cd1b1ce6da5e44487d1ad0dfed5d1495d18f4a7a25edabddb
- SHA512
  
  6a0f8e42d292ef4eed28e1fb7e3b3d5cd3dc372327282e09aeaa54b0657e048a781fd77d1f478ebb930c9445659cb9bfcea6513fc5769b0318d924c9aa247bb7
- SSDEEP
  
  6144:JJLRK58XT9kE2LlKv0Ph3wc80wtQK/fu1d0UWmTb:JJNKmZ7I18XtQKXu1PW
Score

10^/10

redline smokeloader vidar 237 anydesk-usa backdoor discovery infostealer spyware stealer trojan
- Detects Smokeloader packer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1