redline

General

Target

6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.zip
Size

2.3MB
Sample

240402-nh2w6agc7y
MD5

83f161bad42e54cee30f5e9688a71de5
SHA1

9fd46d069126ab2846044f96c63bedf44d8099f2
SHA256

d821f67cf00a3ffb8c9499e1f6c40ffccf7bdb9e971e3a87a5d4e915eb6830b4
SHA512

4882dbe8055bed4787c366278efaef504f0e44ecad585bd2249b3823d13424e9f5a4b0e7847cfd585650f7b5bfd320065c4dcb62f0f062ac7a2bfc68fc4f3176
SSDEEP

49152:NvYNCPS4IQySZP1jxP1IBqlA3pq6oqB3ssOwFg1qjF3imj4:NvYNlJQrjj8o68rgIR1q5k

Score

10^/10

redline sectoprat xmrig tg discovery evasion infostealer miner persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

tg

C2

163.5.112.53:51523

Targets

- Target
  
  6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
- Size
  
  2.6MB
- MD5
  
  55e393da1714013720ddf266c7906f43
- SHA1
  
  91a636913604184c010c2d9e0b331a804a2c0ab4
- SHA256
  
  6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957
- SHA512
  
  40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a
- SSDEEP
  
  49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z
Score

10^/10

redline sectoprat xmrig tg discovery evasion infostealer miner persistence rat spyware stealer trojan upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2