redline

General

Target

0097-CGM CIGIEMME S.p.A.tar
Size

463KB
Sample

240703-mlwzmssdkp
MD5

a4d341cca3becd8b15f93ecb569e57e6
SHA1

dfc5bced2f6654f8818a8d1551b4342c0a0e6a81
SHA256

b60eb287b5fe5d4232455cf8abc0229de1a144a6e7179fb996b808968bc72e04
SHA512

2beede2d5b87f248b8c359632545068407c7c4e7232f091894cc82851d5cb91191948b9cf00fc5afc49917154b313c45a55c1971e498f7e6aef2cb64f9836bad
SSDEEP

12288:6gKnrFdlnDkXFnKKBcfYp/w2rY+f71z0OwHjaf:6/Bd2JKK//w2rY+z1GH6

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

halle

C2

194.55.186.180:55123

Targets

- Target
  
  0097-CGM CIGIEMME S.p.A.exe
- Size
  
  3.1MB
- MD5
  
  a1dee348cae0e72e34756c1af67a1ee3
- SHA1
  
  c1762e92c78d384273df732e0480bdc00602befe
- SHA256
  
  4815528e2ce6e19bd348bdb89dd59ccc8d2b5dd6432074daa92e86f45f4a5604
- SHA512
  
  c7235d1eb1ff5a3b2f26462eb93bf8a6f5968de06cd8c8909341522028b7670c1534d00e5a46378c96933569665c7e88a7e4692fc52fbdd70a512e4dd9e5f9b1
- SSDEEP
  
  12288:NNjXXcgKOAjxi0eF50N8y8kWtJJsn4VxSHunc:HHctOmBQKn6EOc
Score

10^/10

redline sectoprat halle discovery evasion execution infostealer rat spyware stealer trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2