General
-
Target
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
-
Size
336KB
-
Sample
211024-ljc83sefbm
-
MD5
ce3b37511bcf0f509b20f5ca0085badb
-
SHA1
cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0
-
SHA256
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
-
SHA512
c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61
Static task
static1
Behavioral task
behavioral1
Sample
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
Resource
win10-en-20210920
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Targets
-
-
Target
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
-
Size
336KB
-
MD5
ce3b37511bcf0f509b20f5ca0085badb
-
SHA1
cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0
-
SHA256
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
-
SHA512
c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-