redline

General

Target

6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.zip
Size

2.3MB
Sample

240402-lt4h1sdf34
MD5

fe611dc9a986cccac88f7665ccbb17bb
SHA1

610fb4a3127e8003aa603710983d40ba92013147
SHA256

30b51eec2ccbdf53dcfb42afae683ac5b14e305ea11af8723072c3ddc1079fb7
SHA512

743c77789afea3473e34a9ea2af00ae77e119a271e10c1d65e044fce43b3bff20b101ab734da3f46d09003f80b0242052c17efe0943868845289970e0e29f5d2
SSDEEP

49152:kOgx+BguZDWYZHtLoyb9zvE+61hATRiZKHZ5dZxZCOqHa0Z2ixR4:l67uZDZNLogvEn1hAjZfZxcK0Z34

Score

10^/10

redline sectoprat xmrig tg discovery evasion infostealer miner persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

tg

C2

163.5.112.53:51523

Targets

- Target
  
  6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
- Size
  
  2.6MB
- MD5
  
  55e393da1714013720ddf266c7906f43
- SHA1
  
  91a636913604184c010c2d9e0b331a804a2c0ab4
- SHA256
  
  6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957
- SHA512
  
  40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a
- SSDEEP
  
  49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z
Score

10^/10

redline sectoprat xmrig tg discovery evasion infostealer miner persistence rat spyware stealer trojan upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2