General
-
Target
ecc95feeb482af01eb5ed90d3a003dc4fac3e1d0d6e4627f9497fe83f87a2070
-
Size
218KB
-
Sample
211210-krt15afhd8
-
MD5
329096f5fae6abed39a7d88c40544c0a
-
SHA1
c47cecb7581b713d9c188f250792752d73b56d01
-
SHA256
ecc95feeb482af01eb5ed90d3a003dc4fac3e1d0d6e4627f9497fe83f87a2070
-
SHA512
39a175130232ce0c4d0cd96112dcb641abadad39f6d7ac7e072be53a2a8c3e6a9a42233ee5cd81b8c2537c35ca5bb059b903fef572746ee9975d0d1e349e3b8a
Static task
static1
Behavioral task
behavioral1
Sample
ecc95feeb482af01eb5ed90d3a003dc4fac3e1d0d6e4627f9497fe83f87a2070.exe
Resource
win10-en-20211208
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Targets
-
-
Target
ecc95feeb482af01eb5ed90d3a003dc4fac3e1d0d6e4627f9497fe83f87a2070
-
Size
218KB
-
MD5
329096f5fae6abed39a7d88c40544c0a
-
SHA1
c47cecb7581b713d9c188f250792752d73b56d01
-
SHA256
ecc95feeb482af01eb5ed90d3a003dc4fac3e1d0d6e4627f9497fe83f87a2070
-
SHA512
39a175130232ce0c4d0cd96112dcb641abadad39f6d7ac7e072be53a2a8c3e6a9a42233ee5cd81b8c2537c35ca5bb059b903fef572746ee9975d0d1e349e3b8a
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies RDP port number used by Windows
-
Sets DLL path for service in the registry
-
Deletes itself
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-