redline

General

Target

c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe
Size

4.3MB
Sample

240529-cb864sef84
MD5

b162133322f47da52b67dab3f9b3b21e
SHA1

2c2ff9390bb11ae1f62a3973cf97d39be150639d
SHA256

c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1
SHA512

71548751c2094aa5b27228198541487616dda78b8f06239188cc57b2509903b7d1b5ca00447363e0a1cbe504eb72ce05dbcff258aac5d50d3e366dec32ec4491
SSDEEP

24576:qmkYu1/Al/K6eVhA0mNC301+S45EcnlqZBU6jWUSiQoaUl4IZlWQyhvAYtkEwrSX:qmkYu1/AlC6o01qE46DZlxgXIf44cl

Score

10^/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000

Attributes

Install_directory
%ProgramData%
install_file
cmd.exe
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

redline

Botnet

DOCX

C2

beshomandotestbesnd.run.place:1111

Targets

- Target
  
  c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1.exe
- Size
  
  4.3MB
- MD5
  
  b162133322f47da52b67dab3f9b3b21e
- SHA1
  
  2c2ff9390bb11ae1f62a3973cf97d39be150639d
- SHA256
  
  c8edbc2a072ac9e68a46868aeb7c996aa5d1fe5f8afb3d8ff15b1be4cb3a52a1
- SHA512
  
  71548751c2094aa5b27228198541487616dda78b8f06239188cc57b2509903b7d1b5ca00447363e0a1cbe504eb72ce05dbcff258aac5d50d3e366dec32ec4491
- SSDEEP
  
  24576:qmkYu1/Al/K6eVhA0mNC301+S45EcnlqZBU6jWUSiQoaUl4IZlWQyhvAYtkEwrSX:qmkYu1/AlC6o01qE46DZlxgXIf44cl
Score

10^/10

redline sectoprat xworm docx discovery evasion execution infostealer persistence rat spyware stealer themida trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Xworm Payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables containing artifacts associated with disabling Widnows Defender
- Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
- Detects executables packed with Themida
- Detects executables using Telegram Chat Bot
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2