General
-
Target
bfb63daf8e5d09c7a464bfec38d2d5e4737bd3d2c04974616ef46b5ffddcc8f1
-
Size
219KB
-
Sample
211210-enk16afce3
-
MD5
b03090cd1bd177ae33407bf0660045ed
-
SHA1
2813830526d47eda025534dcf6956b468b340dcd
-
SHA256
bfb63daf8e5d09c7a464bfec38d2d5e4737bd3d2c04974616ef46b5ffddcc8f1
-
SHA512
b4b107b6edb252369e850c31fb6dd04616236bf3f44298b2e85d09d47f7167d870d625012dfae070f8f10ed6431712aff5c58ff68a0bbcdb2b6a62843e72f037
Static task
static1
Behavioral task
behavioral1
Sample
bfb63daf8e5d09c7a464bfec38d2d5e4737bd3d2c04974616ef46b5ffddcc8f1.exe
Resource
win10-en-20211208
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Targets
-
-
Target
bfb63daf8e5d09c7a464bfec38d2d5e4737bd3d2c04974616ef46b5ffddcc8f1
-
Size
219KB
-
MD5
b03090cd1bd177ae33407bf0660045ed
-
SHA1
2813830526d47eda025534dcf6956b468b340dcd
-
SHA256
bfb63daf8e5d09c7a464bfec38d2d5e4737bd3d2c04974616ef46b5ffddcc8f1
-
SHA512
b4b107b6edb252369e850c31fb6dd04616236bf3f44298b2e85d09d47f7167d870d625012dfae070f8f10ed6431712aff5c58ff68a0bbcdb2b6a62843e72f037
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies RDP port number used by Windows
-
Sets DLL path for service in the registry
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-