redline

Sharing

Copy URL Twitter E-mail

General

Target
34d9359a2a6b15423c74298520282b9b.exe
Size 7.5MB
Sample240315-pl66qagc5t
SHA256 c24ff96b950f3bff58f53396fe1aae0764209db72ee6489abffeba8855a7bd3f
MD5 34d9359a2a6b15423c74298520282b9b
SHA1 994219595e6e352add2e70188f5ff8cce111fb63
SHA512 880a831cadeaddb040523b21724949b3cb444bb823421b4a5b0f0be8cc8255108a57547b5c18a0877121a8cd4e7c7857afae4e952e4dadf200de10546bb95950
SSDEEP 196608:VKFPXI1QmlVDuauMb5EVFOUIjKlEPCw0517qAZiP:VW41v9uMt5RKSPy17qws
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  34d9359a2a6b15423c74298520282b9b.exe
- Size 7.5MB
- SHA256 c24ff96b950f3bff58f53396fe1aae0764209db72ee6489abffeba8855a7bd3f
- MD5 34d9359a2a6b15423c74298520282b9b
- SHA1 994219595e6e352add2e70188f5ff8cce111fb63
- SHA512 880a831cadeaddb040523b21724949b3cb444bb823421b4a5b0f0be8cc8255108a57547b5c18a0877121a8cd4e7c7857afae4e952e4dadf200de10546bb95950
- SSDEEP 196608:VKFPXI1QmlVDuauMb5EVFOUIjKlEPCw0517qAZiP:VW41v9uMt5RKSPy17qws
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline xmrig zgrat discovery evasion infostealer miner persistence rat spyware stealer themida trojan upx
- Detect ZGRat V1
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  ⌚/38.exe
- Size 4.5MB
- SHA256 477712f48e356d8c77224a1264dd765b1420fc8c0c318b295744a68316b3f055
- MD5 40ecc726bee273961d09301c0316af6e
- SHA1 0a1122398641375babcf28a7feb24d1935011a7f
- SHA512 130911be930bd0911735de6eeae637843ab7c68b48a8213aa9b4dabee9cbfcacdb5d1eb927e14c5bec133bedf6a3c30d0a105d1c2e41aeea3338b9f431ef807d
- SSDEEP 98304:ZR5VLB+g2pSMqgZmqK0scjW0nOs992v6QeoLqELeUpDGxK9jwwLPk4S7cdz5:ZRzLBt2jXkwj3lz2vAouELeU1Gogb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  ⌚/crypt.exe
- Size 412KB
- SHA256 49e3c6738e6d99770ac69d75adde05379910f67bd988c378a7ab53e146510de4
- MD5 084787a02d925fecd0821303aab375ad
- SHA1 d620d2d42a3ee9bb40672d25f93b23fb6f3bbd51
- SHA512 d6e05094e6c1f407996ed3dcdf82ad1dceddb3f9768d59c9b86d573aeb13af7f13d65d806ff6e925197e9ff8f7ff50efaf32da45fcd514df83aec25043f7de68
- SSDEEP 12288:99pVcO+InqVT9zfIyAasfsm5p58TViC18j/i3DsD:XncO+bJgD3+pR8riT0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  ⌚/sfasfafs.exe
- Size 5.2MB
- SHA256 5b1cfa7129a5d5d030d207774022ea3a7d50375c4a6a3291621a71641dda45c2
- MD5 27f4c8db69b471adac1d5ccfd0ff68d5
- SHA1 4e66a5f0cf3019e4c095827429fe93c8b4833550
- SHA512 b261ebf44443e6811bbd1ef4aa5cb5110676fffd2dcfe12cb709be65dfe29d1a285ce524b05c73a2aa51fdcca97b5e2fdaaa5e7e74313d7eb750f352a89d42fb
- SSDEEP 98304:UDNQJNkbEQ2vVSecOVRS7jAXIt2zvyeT5CrhS7CSGE:URrecoRS7lt2zFT4l+CS7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8