General
-
Target
https://cdn-141.anonfiles.com/F2fbm8nfz7/4c04950e-1682773464/Redline+Stealer+v24.2+cracked+%5BXT_CH%5D.rar
-
Sample
230429-qcaxlaah76
Malware Config
Extracted
pandastealer
��H
http://�H
Extracted
pandastealer
1.11
http://thisisgenk.temp.swtest.ru
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6093966625:AAHk4dddHb8B1faCcFqL3um1gmB-f2mWhyc/sendMessage?chat_id=5529838804
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
https://cdn-141.anonfiles.com/F2fbm8nfz7/4c04950e-1682773464/Redline+Stealer+v24.2+cracked+%5BXT_CH%5D.rar
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Panda Stealer payload
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-