Redline Stealer Disguised as AnyDesk Software

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

• Redline information stealer malware impacting a customer in the insurance industry.
• The infection was initiated by a user downloading and running a fake installer for the AnyDesk software.
  • We assess the victim arrived on anydezki[.]org via a malicious advertisement while performing a web search for AnyDesk software (Figure 1).
  • The victim downloaded and mounted a 300MB ISO file and executed the binary (AutoDesk.exe) contained within.
  • Once executed, the AutoDesk.exe performed connectivity checks before dropping several files, including an AutoIT binary and script containing an RC4 encrypted (key:9318336389) Redline Stealer payload embedded within.
  • The payload was injected into C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe and the stealer established connection with the C2 (185[.]143[.]223[.]9).
• eSentire has previously published detailed malware analysis of a similar information stealing malware, Mars Stealer, executed using AutoIT scripts here.

How did we find it?

• eSentire MDR for Endpoint identified the AutoIT activity.

What did we do?

• Our team of 24/7 SOC Cyber Analysts investigated the incident and isolated the system while the threat was remediated on the customer’s behalf.

What can you learn from this TRU positive?

• Redline Stealer is a capable general-purpose infostealer malware that targets an array of information on infected systems, such as sensitive data (e.g., user credentials) from browsers, FTP clients, chat applications, cryptocurrency wallets, and VPN applications (Figure 2).
• Redline operates as a malware-as-a-service and can be rented for around $100-200USD.
• Stolen data can be sold through various marketplaces such as 2easy or Russian Market, with Redline being a commonly observed source.
• There is significant cyber risk in the weaponization of stolen login credentials for remote access services in follow-on attacks by the primary threat actor or a secondary actor that has acquired the credentials from a Dark Web marketplace.

Recommendations from our Threat Response Unit (TRU) Team:

Protecting against information stealers requires a multi-layered defense approach to defend endpoints from malware and detect or block unauthorized login activity against applications and remote access services. Therefore, we recommend:

• Protecting all endpoints against malware.
  • Ensure antivirus signatures are up-to-date.
  • Use a Next-Gen AV (NGAV) or Endpoint Detection and Response (EDR) product to detect and contain threats.
  • In the event that an information stealing malware is identified, reset the user credentials and terminate logon sessions immediately.
• Encouraging good cybersecurity hygiene among your users using Phishing and Security Awareness Training (PSAT) when downloading software from the Internet.
• Restricting access to enterprise applications from personal devices outside the scope of security monitoring.
• Ensuring adequate logging is in place for remote access services such as VPNs and using modern authentication methods, which support MFA and conditional access.

Ask Yourself…

• Can you identify information stealers and limit the impact of compromised user credentials?
• Do you have endpoint monitoring in place?

Indicators of Compromise

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Cybersecurity Specialist.