General
-
Target
0e439b622658ab71228c7388ec456c7baf041046d7eff1a37bc9c02177c324ed.exe
-
Size
281KB
-
Sample
210823-zag5sajdna
-
MD5
1456183e34298fd19d33d75df3bfa1f9
-
SHA1
f3988800cc013e843fa4e4673dc40678453cb18c
-
SHA256
0e439b622658ab71228c7388ec456c7baf041046d7eff1a37bc9c02177c324ed
-
SHA512
d55fc8176ddddac84ad5f529016991679c1ce1e345294c0b5b610a1a4b95891aa499d32cb48b618770b992f5bf2028fcf0e7b5db90b6cb1357262ecb8b816441
Static task
static1
Behavioral task
behavioral1
Sample
0e439b622658ab71228c7388ec456c7baf041046d7eff1a37bc9c02177c324ed.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0e439b622658ab71228c7388ec456c7baf041046d7eff1a37bc9c02177c324ed.exe
Resource
win10v20210408
Malware Config
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
redline
185.215.113.29:8678
Extracted
redline
@soul3ss
188.130.139.12:30376
Targets
-
-
Target
0e439b622658ab71228c7388ec456c7baf041046d7eff1a37bc9c02177c324ed.exe
-
Size
281KB
-
MD5
1456183e34298fd19d33d75df3bfa1f9
-
SHA1
f3988800cc013e843fa4e4673dc40678453cb18c
-
SHA256
0e439b622658ab71228c7388ec456c7baf041046d7eff1a37bc9c02177c324ed
-
SHA512
d55fc8176ddddac84ad5f529016991679c1ce1e345294c0b5b610a1a4b95891aa499d32cb48b618770b992f5bf2028fcf0e7b5db90b6cb1357262ecb8b816441
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-