General
-
Target
a266577f134867bc2a7f59cf2c4360118fc1180aae87d89ef70661833ef8a450
-
Size
266KB
-
Sample
211206-xq1thaehdn
-
MD5
b4b5aa9a6cdeb898e74a7d2bca56137d
-
SHA1
b0cba2dcd008a233b9338e7517156e1530ce0a3a
-
SHA256
a266577f134867bc2a7f59cf2c4360118fc1180aae87d89ef70661833ef8a450
-
SHA512
81618cc5c1d8124e1477d949346a00faee2c0899c1b7f2497736b95b89f2d90ad37ced0587eec7e080e96c4045413d734d0de8a77379f83ef43eb4b37c13b78d
Static task
static1
Behavioral task
behavioral1
Sample
a266577f134867bc2a7f59cf2c4360118fc1180aae87d89ef70661833ef8a450.exe
Resource
win10-en-20211014
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Targets
-
-
Target
a266577f134867bc2a7f59cf2c4360118fc1180aae87d89ef70661833ef8a450
-
Size
266KB
-
MD5
b4b5aa9a6cdeb898e74a7d2bca56137d
-
SHA1
b0cba2dcd008a233b9338e7517156e1530ce0a3a
-
SHA256
a266577f134867bc2a7f59cf2c4360118fc1180aae87d89ef70661833ef8a450
-
SHA512
81618cc5c1d8124e1477d949346a00faee2c0899c1b7f2497736b95b89f2d90ad37ced0587eec7e080e96c4045413d734d0de8a77379f83ef43eb4b37c13b78d
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
ModiLoader First Stage
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-