General
-
Target
C7304FF0966068D305DA031F9DA60C5B0EBE32AC43533.exe
-
Size
4.4MB
-
Sample
211204-wlwhjsbdfj
-
MD5
d13d7a330bd2b99acb5c445bb14ab499
-
SHA1
0a598d94482ab95fe1ecd2a0741eb39b7d7defb2
-
SHA256
c7304ff0966068d305da031f9da60c5b0ebe32ac43533d27f50190f1ba549347
-
SHA512
9c754fb692a95daeb895cfd4acbb09b84c80b217b5b7dfb27ae75bc9ae9560e8a8e09e49424fcffaba0e2f365b79fb51fc4a69f5b580f0ddb1308c896d33d82c
Static task
static1
Behavioral task
behavioral1
Sample
C7304FF0966068D305DA031F9DA60C5B0EBE32AC43533.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
C7304FF0966068D305DA031F9DA60C5B0EBE32AC43533.exe
Resource
win10-en-20211104
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
raccoon
2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
-
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
Extracted
redline
Chris
194.104.136.5:46013
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Extracted
redline
media18
91.121.67.60:2151
Extracted
redline
fucker2
135.181.129.119:4805
Targets
-
-
Target
C7304FF0966068D305DA031F9DA60C5B0EBE32AC43533.exe
-
Size
4.4MB
-
MD5
d13d7a330bd2b99acb5c445bb14ab499
-
SHA1
0a598d94482ab95fe1ecd2a0741eb39b7d7defb2
-
SHA256
c7304ff0966068d305da031f9da60c5b0ebe32ac43533d27f50190f1ba549347
-
SHA512
9c754fb692a95daeb895cfd4acbb09b84c80b217b5b7dfb27ae75bc9ae9560e8a8e09e49424fcffaba0e2f365b79fb51fc4a69f5b580f0ddb1308c896d33d82c
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Socelars Payload
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE Suspicious Download Setup_ exe
suricata: ET MALWARE Suspicious Download Setup_ exe
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-