redline | 137c0ebdcc26e8ec716854e2096d54cc8f0fc1bd320400c868084be3acb493be

General

Target
137c0ebdcc26e8ec716854e2096d54cc8f0fc1bd320400c868084be3acb493be.bin
Size 24.8MB
Sample260808-k8nwfacf92
SHA256 137c0ebdcc26e8ec716854e2096d54cc8f0fc1bd320400c868084be3acb493be
MD5 3afafc3a4f3d93f451bae464f3e02a84
SHA1 7aeaff04e058924f3af2754e6d7b0c7fdfe14839
SHA512 5286f20467971b76aeaf01c3881cc22abb081d5536c1dc1babb2c72db33c581591fa52956e4ec43219794fead6320d45870bce5c0e15d3ce71158e04aa60b7e1
SSDEEP 786432:91FLXqrRtbycFxVedYSTDnQHuL/sVsH25c0s:91NqrvbycFXed1QgWW0s
TLSH
T14E47335AA3A504F9D5BB8139C9628562D7B1BC214720C7DF07E44E672F273E0AE3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

stealc

Botnet

WQaa7wCkfe7anA==

Extracted

Family

stealc

Botnet

01x02x2026

C2

http://196.251.107.130

Attributes

url_path
/cfedbcab777558b8.php

rc4.traffic_key

rc4.C2

Extracted

Family

redline

Botnet

ddwwnnll

C2

196.251.107.104:1912

Extracted

Family

svcstealer

C2

http://196.251.107.130/zbuyowgn/data.php
http://62.60.226.159/zbuyowgn/data.php
http://196.251.107.23/diamo/data.php
http://178.16.53.7/diamo/data.php
http://158.94.208.102/diamo/data.php
http://196.251.107.61/diamo/data.php

Attributes

bot_urls
http://196.251.107.23/bot64.dll
build_id
27/11/2025
srv_delay
1
srv_retry
1

Extracted

Family

xtinyloader

C2

196.251.107.130

Wallets

TBfVoNhyiBzrWXRi9erWH1d8BdpFNoB7dt

Targets

- Target
  137c0ebdcc26e8ec716854e2096d54cc8f0fc1bd320400c868084be3acb493be.bin
- Size 24.8MB
- SHA256 137c0ebdcc26e8ec716854e2096d54cc8f0fc1bd320400c868084be3acb493be
- MD5 3afafc3a4f3d93f451bae464f3e02a84
- SHA1 7aeaff04e058924f3af2754e6d7b0c7fdfe14839
- SHA512 5286f20467971b76aeaf01c3881cc22abb081d5536c1dc1babb2c72db33c581591fa52956e4ec43219794fead6320d45870bce5c0e15d3ce71158e04aa60b7e1
- SSDEEP 786432:91FLXqrRtbycFxVedYSTDnQHuL/sVsH25c0s:91NqrvbycFXed1QgWW0s
- TLSH
  T14E47335AA3A504F9D5BB8139C9628562D7B1BC214720C7DF07E44E672F273E0AE3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

01x02x2026 ddwwnnll discovery downloader execution redline stealc svcstealer xtinyloader infostealer loader persistence pyinstaller stealer
- Detects Stealc stealer Version 2
- Family: RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Family: Stealc
  Stealc is an infostealer written in C++.
  stealer stealc
- Family: SvcStealer, Diamotrix
  SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
  stealer downloader svcstealer
- Family: XTinyLoader
  XTinyLoader is a modular loader and stealer.
  loader stealer xtinyloader
- RedLine payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2