General
-
Target
b7915e2c423abfd40c013439cc726587a44fc207696637b2a431abce68963dd4.exe
-
Size
2.5MB
-
Sample
210830-2h1f1et48j
-
MD5
7e9acb5b9dd42cebd1bc1fd896730da3
-
SHA1
89ea1cbe5189bc86df11c1328e229dd7f3a6c86e
-
SHA256
b7915e2c423abfd40c013439cc726587a44fc207696637b2a431abce68963dd4
-
SHA512
d7f65adebbceca89b6bb93f9854996840e6c0daacbf92e16570589f99b024c8ca8f3e783415c4fdf22fb5797717d5d41b66ccc42a56ae099d436b4a52257b4dc
Static task
static1
Behavioral task
behavioral1
Sample
b7915e2c423abfd40c013439cc726587a44fc207696637b2a431abce68963dd4.exe
Resource
win7v20210408
Malware Config
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Extracted
redline
292.08
95.181.152.47:15089
Targets
-
-
Target
b7915e2c423abfd40c013439cc726587a44fc207696637b2a431abce68963dd4.exe
-
Size
2.5MB
-
MD5
7e9acb5b9dd42cebd1bc1fd896730da3
-
SHA1
89ea1cbe5189bc86df11c1328e229dd7f3a6c86e
-
SHA256
b7915e2c423abfd40c013439cc726587a44fc207696637b2a431abce68963dd4
-
SHA512
d7f65adebbceca89b6bb93f9854996840e6c0daacbf92e16570589f99b024c8ca8f3e783415c4fdf22fb5797717d5d41b66ccc42a56ae099d436b4a52257b4dc
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-