General
-
Target
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03.exe
-
Size
335KB
-
Sample
211024-k2sk2seegj
-
MD5
9a2ff6b89422fd5d1c64e51c30386d32
-
SHA1
44ecf3a5f52b4044b84421e654c881868cd0acc6
-
SHA256
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
-
SHA512
8a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701
Static task
static1
Behavioral task
behavioral1
Sample
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03.exe
Resource
win10-en-20210920
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Targets
-
-
Target
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03.exe
-
Size
335KB
-
MD5
9a2ff6b89422fd5d1c64e51c30386d32
-
SHA1
44ecf3a5f52b4044b84421e654c881868cd0acc6
-
SHA256
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
-
SHA512
8a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-