General
-
Target
de018f1f3a8d601e53358b567baa3cd063a2d933ee7e7556705b88de5bf2d5b4
-
Size
262KB
-
Sample
211025-hcrlcagfcp
-
MD5
10a6312533bf2ec0570feda002d04e4e
-
SHA1
f36714c765c4f86fe0bc04cdc6b4d8efa9b3b7fa
-
SHA256
de018f1f3a8d601e53358b567baa3cd063a2d933ee7e7556705b88de5bf2d5b4
-
SHA512
0366dcaf0d5f8e5c4e465bbee8fb01997f596ee209533db606df0210fa9400187fa3b2f3ce71e310aefe276d801e30fe7c368c9a0497504ebc055fefb0a61dd2
Static task
static1
Behavioral task
behavioral1
Sample
de018f1f3a8d601e53358b567baa3cd063a2d933ee7e7556705b88de5bf2d5b4.exe
Resource
win10-en-20210920
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Targets
-
-
Target
de018f1f3a8d601e53358b567baa3cd063a2d933ee7e7556705b88de5bf2d5b4
-
Size
262KB
-
MD5
10a6312533bf2ec0570feda002d04e4e
-
SHA1
f36714c765c4f86fe0bc04cdc6b4d8efa9b3b7fa
-
SHA256
de018f1f3a8d601e53358b567baa3cd063a2d933ee7e7556705b88de5bf2d5b4
-
SHA512
0366dcaf0d5f8e5c4e465bbee8fb01997f596ee209533db606df0210fa9400187fa3b2f3ce71e310aefe276d801e30fe7c368c9a0497504ebc055fefb0a61dd2
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-