General
-
Target
setup_x86_x64_install.exe
-
Size
4.6MB
-
Sample
210926-r8qtcsfac3
-
MD5
f7cf8f9694e81ee7d8af08ebb8324bc0
-
SHA1
28183d4304bc8257b9e3bf922c2d684075bdf552
-
SHA256
84b57d3d7fdabaebcd85cf01dbf14b9cb94e08fe081abcb60b218c1298c55995
-
SHA512
402fb16fb00cce4146bb7720317b7040d9987fb80b1beeda95e47158f8652fa6da70eb10b99ec64ebd49db3942fad0dcd349f6b3bbe1bce8178e730a13083e22
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-en-20210920
Malware Config
Extracted
smokeloader
2020
http://govsurplusstore.com/upload/
http://best-forsale.com/upload/
http://chmxnautoparts.com/upload/
http://kwazone.com/upload/
Extracted
redline
jamesoldd
65.108.20.195:6774
Extracted
http://shellloader.top/welcome
Targets
-
-
Target
setup_x86_x64_install.exe
-
Size
4.6MB
-
MD5
f7cf8f9694e81ee7d8af08ebb8324bc0
-
SHA1
28183d4304bc8257b9e3bf922c2d684075bdf552
-
SHA256
84b57d3d7fdabaebcd85cf01dbf14b9cb94e08fe081abcb60b218c1298c55995
-
SHA512
402fb16fb00cce4146bb7720317b7040d9987fb80b1beeda95e47158f8652fa6da70eb10b99ec64ebd49db3942fad0dcd349f6b3bbe1bce8178e730a13083e22
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Socelars Payload
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-