General
-
Target
Bear_Vpn.exe
-
Size
9.3MB
-
Sample
210723-ly53sq6y8x
-
MD5
56bd0f698f28e63479e5697dd167926e
-
SHA1
a65ab942eb3b3ac45ecf24cf1a35d2734f14d666
-
SHA256
6a481c56aa97b2a75a3de488ce1a9a670c62fc364a432e8e68497f55fabb439d
-
SHA512
f8900374349e22a2eb2c4ae2598bb1ed5b0dd3ca2857e2fb10d2ed3474fea49a810eb92eb3a81e861bd47c54698fa934fe086bca7da6a1f164c34753b6d391f2
Malware Config
Extracted
redline
AniNEW
akedauiver.xyz:80
Targets
-
-
Target
Bear_Vpn.exe
-
Size
9.3MB
-
MD5
56bd0f698f28e63479e5697dd167926e
-
SHA1
a65ab942eb3b3ac45ecf24cf1a35d2734f14d666
-
SHA256
6a481c56aa97b2a75a3de488ce1a9a670c62fc364a432e8e68497f55fabb439d
-
SHA512
f8900374349e22a2eb2c4ae2598bb1ed5b0dd3ca2857e2fb10d2ed3474fea49a810eb92eb3a81e861bd47c54698fa934fe086bca7da6a1f164c34753b6d391f2
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-