redline

General

Target

tmp
Size

185KB
Sample

230619-eq62eabd27
MD5

f50c7021faf8880c50cb092669bccf9b
SHA1

302d730bad4222d1748a863da3f8bf2368b88e65
SHA256

14a81d39c1a2260f7dde336245ab276a3416319e8bea2740107f8da6b5baecc2
SHA512

8544961a0ce6d2d2f6e2cd61b5d9be07cf23d3c1de0860008efc08ec7ed3594af21cfe575bf52aca1fcdda150c7a4fe3e2ea46c4bd8d9a6abaef0178d1be19d3
SSDEEP

3072:MtaBjZDS2BKsgTnZOXefxHgndnmBT7bZTDhYqgxAnLY:MgBNDfBKbZOXepHg9mBX9XhY5

Score

10^/10

redline smokeloader systembc 1 summ backdoor discovery exploit infostealer pyinstaller spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

summ

Extracted

Family

smokeloader

Version

2022

C2

http://stalagmijesarl.com/

http://ukdantist-sarl.com/

http://cpcorprotationltd.com/

rc4.i32

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.81.224.130/any.exe

Extracted

Family

systembc

C2

admex1955x.xyz:4044

servx2785x.xyz:4044

Extracted

Family

redline

Botnet

1

C2

213.239.213.187:17260

Attributes

auth_value
6a4b05ef943a0dd801fd01dfbb9eb717

Targets

- Target
  
  tmp
- Size
  
  185KB
- MD5
  
  f50c7021faf8880c50cb092669bccf9b
- SHA1
  
  302d730bad4222d1748a863da3f8bf2368b88e65
- SHA256
  
  14a81d39c1a2260f7dde336245ab276a3416319e8bea2740107f8da6b5baecc2
- SHA512
  
  8544961a0ce6d2d2f6e2cd61b5d9be07cf23d3c1de0860008efc08ec7ed3594af21cfe575bf52aca1fcdda150c7a4fe3e2ea46c4bd8d9a6abaef0178d1be19d3
- SSDEEP
  
  3072:MtaBjZDS2BKsgTnZOXefxHgndnmBT7bZTDhYqgxAnLY:MgBNDfBKbZOXepHg9mBX9XhY5
Score

10^/10

smokeloader summ backdoor trojan redline systembc 1 discovery exploit infostealer pyinstaller spyware stealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Blocklisted process makes network request
- Downloads MZ/PE file
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2