General
-
Target
a0d966c2ff40b2f4d70f25d26b5b6a06.exe
-
Size
5.1MB
-
Sample
211002-cmsy9sdecm
-
MD5
a0d966c2ff40b2f4d70f25d26b5b6a06
-
SHA1
f7bfb05cadf646aa2076561321a28ea32ce3572f
-
SHA256
a3507dc0b236809b00d1e1b8481607e75b2085a6cfeebab4d50ba816502adb29
-
SHA512
e8e1fbe174f26eeed85fbf8b54b3336f0aec358ed220a18dc3c4ab284b943c8186445afac314c13a7024cb3ff989b38e7ebcb2df34afe7152ce964f4435c385c
Static task
static1
Behavioral task
behavioral1
Sample
a0d966c2ff40b2f4d70f25d26b5b6a06.exe
Resource
win7-en-20210920
Malware Config
Extracted
vidar
41
706
https://mas.to/@killern0
-
profile_id
706
Extracted
smokeloader
2020
http://govsurplusstore.com/upload/
http://best-forsale.com/upload/
http://chmxnautoparts.com/upload/
http://kwazone.com/upload/
Extracted
redline
jamesoldd
65.108.20.195:6774
Extracted
redline
media26
91.121.67.60:62102
Extracted
vidar
41
933
https://mas.to/@killern0
-
profile_id
933
Targets
-
-
Target
a0d966c2ff40b2f4d70f25d26b5b6a06.exe
-
Size
5.1MB
-
MD5
a0d966c2ff40b2f4d70f25d26b5b6a06
-
SHA1
f7bfb05cadf646aa2076561321a28ea32ce3572f
-
SHA256
a3507dc0b236809b00d1e1b8481607e75b2085a6cfeebab4d50ba816502adb29
-
SHA512
e8e1fbe174f26eeed85fbf8b54b3336f0aec358ed220a18dc3c4ab284b943c8186445afac314c13a7024cb3ff989b38e7ebcb2df34afe7152ce964f4435c385c
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Socelars Payload
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
-
Vidar Stealer
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-