General
-
Target
acdc44f3c8b2b8b12a3e396a3d9f5d353d17dab46b0e7d7cf39113e2e91d66a1.exe
-
Size
3.2MB
-
Sample
210903-gr1l5affgk
-
MD5
c304acbf327cdb8f30afb29220277d51
-
SHA1
1f33fe2bb3d14061865f3c9fc46be2d1ddf99730
-
SHA256
acdc44f3c8b2b8b12a3e396a3d9f5d353d17dab46b0e7d7cf39113e2e91d66a1
-
SHA512
5d0ff4e307f869a149ae9cf9a7db9a6d68b674a45105556b534884860bd859d761b4ac35b4151edcd11c6a7e471440498004d58386b3f34cf043556083e5f9e3
Static task
static1
Behavioral task
behavioral1
Sample
acdc44f3c8b2b8b12a3e396a3d9f5d353d17dab46b0e7d7cf39113e2e91d66a1.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
acdc44f3c8b2b8b12a3e396a3d9f5d353d17dab46b0e7d7cf39113e2e91d66a1.exe
Resource
win10-en
Malware Config
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
redline
185.215.113.29:8678
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
redline
Cana
176.111.174.254:56328
Extracted
redline
DomAni2
flestriche.xyz:80
Targets
-
-
Target
acdc44f3c8b2b8b12a3e396a3d9f5d353d17dab46b0e7d7cf39113e2e91d66a1.exe
-
Size
3.2MB
-
MD5
c304acbf327cdb8f30afb29220277d51
-
SHA1
1f33fe2bb3d14061865f3c9fc46be2d1ddf99730
-
SHA256
acdc44f3c8b2b8b12a3e396a3d9f5d353d17dab46b0e7d7cf39113e2e91d66a1
-
SHA512
5d0ff4e307f869a149ae9cf9a7db9a6d68b674a45105556b534884860bd859d761b4ac35b4151edcd11c6a7e471440498004d58386b3f34cf043556083e5f9e3
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-