General
-
Target
3751405dca827971272b7682e18edf9309453fcc58fabb259d72db8712573334
-
Size
296KB
-
Sample
211016-b3lpfsbfb7
-
MD5
029b23741524418d56963e68daa9e5fe
-
SHA1
8ce91f140bde7c7f7461d06794dacc8a58730866
-
SHA256
3751405dca827971272b7682e18edf9309453fcc58fabb259d72db8712573334
-
SHA512
49da781a7c38c6761f6ee64ccfe7beb21d172ce8037e9fb78b80ccf56c82c2445547dda4b21031776670549af912227ded57d1868aab3faa83f7175bff4a8ff6
Static task
static1
Behavioral task
behavioral1
Sample
3751405dca827971272b7682e18edf9309453fcc58fabb259d72db8712573334.exe
Resource
win10-en-20210920
Malware Config
Extracted
smokeloader
2020
http://honawey7.top/
http://wijibui0.top/
http://hefahei6.top/
http://pipevai4.top/
http://nalirou7.top/
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Extracted
redline
MD
185.7.214.214:7778
Targets
-
-
Target
3751405dca827971272b7682e18edf9309453fcc58fabb259d72db8712573334
-
Size
296KB
-
MD5
029b23741524418d56963e68daa9e5fe
-
SHA1
8ce91f140bde7c7f7461d06794dacc8a58730866
-
SHA256
3751405dca827971272b7682e18edf9309453fcc58fabb259d72db8712573334
-
SHA512
49da781a7c38c6761f6ee64ccfe7beb21d172ce8037e9fb78b80ccf56c82c2445547dda4b21031776670549af912227ded57d1868aab3faa83f7175bff4a8ff6
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-