redline

General

Target

036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40
Size

915KB
Sample

240526-ztr2wach58
MD5

8e38e8ecd481eb08ceaa4ae363251311
SHA1

8c2a06c4c7b52cb9cd01c414732597e9289b3ad4
SHA256

036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40
SHA512

c02a7be29b8012778a9028b67d71384e0a6a60857f880bf858099aef5a41a21c0068cfd2ff4116176493c28938d5e799ca18738a6e29335c3423f895305d016f
SSDEEP

24576:7tASL4DpnNBcMxDlxTWTn6WHmTSHMLir8/dp97A:f4DpnNBcMTxTyYSY1P7A

Score

10^/10

redline xmrig logsdiller cloud (tg: @logsdillabot)discovery evasion execution infostealer miner persistence spyware stealer upx

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.115:40551

Targets

- Target
  
  036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40
- Size
  
  915KB
- MD5
  
  8e38e8ecd481eb08ceaa4ae363251311
- SHA1
  
  8c2a06c4c7b52cb9cd01c414732597e9289b3ad4
- SHA256
  
  036fb259b53e5db9dbe7039bd4a2c5e2118b3242e38e9c0cc697e4e4c44b9f40
- SHA512
  
  c02a7be29b8012778a9028b67d71384e0a6a60857f880bf858099aef5a41a21c0068cfd2ff4116176493c28938d5e799ca18738a6e29335c3423f895305d016f
- SSDEEP
  
  24576:7tASL4DpnNBcMxDlxTWTn6WHmTSHMLir8/dp97A:f4DpnNBcMTxTyYSY1P7A
Score

10^/10

redline xmrig logsdiller cloud (tg: @logsdillabot)discovery evasion execution infostealer miner persistence spyware stealer upx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2