redline

General

Target

6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.zip
Size

2.3MB
Sample

240402-qbgzhsag87
MD5

c9d32518f162a5ee02ae4df9020bbbbb
SHA1

f65de32c2b70017775a1f58151ed667f2e166e13
SHA256

61f3a2572f203c05366b5ddd6c208fe65b5e960f195689c456b742d7339c667c
SHA512

7c1c7cb14b6940e6de1b0e4feed346bf972b78a3d50465684a99026ec3ec445d69da140a0628288efbed96a64a873291866f9d4cc3ac5d76fd43243059031a16
SSDEEP

49152:4I6DIDvzEoyCm7j2ntPU1PUH2Nrvli4OK4Lzcm3Db5jFllwDa0S:jgDHf2FcpTOK413ZDW20S

Score

10^/10

redline sectoprat xmrig tg discovery evasion infostealer miner persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

tg

C2

163.5.112.53:51523

Targets

- Target
  
  6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957.exe
- Size
  
  2.6MB
- MD5
  
  55e393da1714013720ddf266c7906f43
- SHA1
  
  91a636913604184c010c2d9e0b331a804a2c0ab4
- SHA256
  
  6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957
- SHA512
  
  40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a
- SSDEEP
  
  49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z
Score

10^/10

redline sectoprat xmrig tg discovery evasion infostealer miner persistence rat spyware stealer trojan upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Creates new service(s)
  persistence
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2