General
-
Target
5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71
-
Size
241KB
-
Sample
211208-lh26tacbe4
-
MD5
424792509be0ea5b770d3e787f6cc337
-
SHA1
546057d56a1d78c5cc3f38d1a5225e2531228f25
-
SHA256
5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71
-
SHA512
9742a8aaa14ad272c60e0d8ebfef619b6c172284a987e7d8425db8f5fc86c7f40456ed8e77a8aa930a435fda1ee228275903d01cee3ef777e4d6ff9089113c2c
Static task
static1
Behavioral task
behavioral1
Sample
5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71.exe
Resource
win10-en-20211014
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Extracted
icedid
3439131404
grendafolz.com
Extracted
systembc
185.209.30.180:4001
Targets
-
-
Target
5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71
-
Size
241KB
-
MD5
424792509be0ea5b770d3e787f6cc337
-
SHA1
546057d56a1d78c5cc3f38d1a5225e2531228f25
-
SHA256
5e39411fee33dcd9a49c348becbd8cb7dc9df07565fd569c1c262e53d120dd71
-
SHA512
9742a8aaa14ad272c60e0d8ebfef619b6c172284a987e7d8425db8f5fc86c7f40456ed8e77a8aa930a435fda1ee228275903d01cee3ef777e4d6ff9089113c2c
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-