General
-
Target
aff3a21d74b067444d10fd77317ad72d61f136409b6aa0d73c732e3ff3a5a5c6
-
Size
336KB
-
Sample
211024-wcdw5sffhq
-
MD5
eb90aba1005e386ce2d5534ae963e3f4
-
SHA1
4e438c10029bcbeb46f18624bf5a08de5b98040f
-
SHA256
aff3a21d74b067444d10fd77317ad72d61f136409b6aa0d73c732e3ff3a5a5c6
-
SHA512
ff0e4ecdaba2dd401bcd78aa73eb3d61fd05862c4bab46c94a8beb76acbc3ba40cb676b23881d7faa99ed5ca458e7d9b56e4c41c416dccdc03246cf50684b0b5
Static task
static1
Behavioral task
behavioral1
Sample
aff3a21d74b067444d10fd77317ad72d61f136409b6aa0d73c732e3ff3a5a5c6.exe
Resource
win10-en-20211014
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Targets
-
-
Target
aff3a21d74b067444d10fd77317ad72d61f136409b6aa0d73c732e3ff3a5a5c6
-
Size
336KB
-
MD5
eb90aba1005e386ce2d5534ae963e3f4
-
SHA1
4e438c10029bcbeb46f18624bf5a08de5b98040f
-
SHA256
aff3a21d74b067444d10fd77317ad72d61f136409b6aa0d73c732e3ff3a5a5c6
-
SHA512
ff0e4ecdaba2dd401bcd78aa73eb3d61fd05862c4bab46c94a8beb76acbc3ba40cb676b23881d7faa99ed5ca458e7d9b56e4c41c416dccdc03246cf50684b0b5
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-