General
-
Target
setup_x86_x64_install.exe
-
Size
7.8MB
-
Sample
210917-m9gvmafdg3
-
MD5
a1cfa4a945b12ff461ec8bc898b40aa0
-
SHA1
1d07813751d678475c8115b4e25e5816d6d98d9d
-
SHA256
b45aeaafb0e1a0ded6645279d0f828e57550a0b5902373d9e30667d0c3cbdae0
-
SHA512
554d601753266665fe01fe90509ef492ddf92a0625bec527b1a9efa4b4b83831753a6826d3237a1bf9e679428ab1fa1be8fcf6a333e50b1dd6b18697287c3f35
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win10-en
Malware Config
Extracted
http://shellloader.com/welcome
Extracted
redline
ANI
45.142.215.47:27643
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
redline
pab123
45.14.49.169:22411
Extracted
icedid
1738678933
Targets
-
-
Target
setup_x86_x64_install.exe
-
Size
7.8MB
-
MD5
a1cfa4a945b12ff461ec8bc898b40aa0
-
SHA1
1d07813751d678475c8115b4e25e5816d6d98d9d
-
SHA256
b45aeaafb0e1a0ded6645279d0f828e57550a0b5902373d9e30667d0c3cbdae0
-
SHA512
554d601753266665fe01fe90509ef492ddf92a0625bec527b1a9efa4b4b83831753a6826d3237a1bf9e679428ab1fa1be8fcf6a333e50b1dd6b18697287c3f35
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Socelars Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-