redline

General

Target

6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.zip
Size

2.3MB
Sample

240402-mkenzafd76
MD5

4885151d543effde4c953410363612ef
SHA1

22e008ca343573c2b4fb9e09c77728233991082c
SHA256

0127302fe8ae9ffa58b4bdf5d6707dbd6875651b4d4492638efddc1942bb7067
SHA512

8bf5cb496c24a81ca1ad85fbd72bb34b7f95ada4301a25bda1a5728683ba962c91dc21c5a35e0d1faa4684389dd4e8c0acd2c4bf9de58674335f79f4d6ceff13
SSDEEP

49152:bCeGGpn7DZMF58LVzMmSUAVMV2Shc7OzOI3cYgO8yT45l7:btGGt9Mj8hzFp4IiORMYv8v5l7

Score

10^/10

redline sectoprat xmrig tg discovery evasion infostealer miner persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

tg

C2

163.5.112.53:51523

Targets

- Target
  
  6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
- Size
  
  2.6MB
- MD5
  
  55e393da1714013720ddf266c7906f43
- SHA1
  
  91a636913604184c010c2d9e0b331a804a2c0ab4
- SHA256
  
  6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957
- SHA512
  
  40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a
- SSDEEP
  
  49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z
Score

10^/10

redline sectoprat xmrig tg discovery evasion infostealer miner persistence rat spyware stealer trojan upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2