General
-
Target
299b283fe0e14bd9b33838858a4e6342d2000b5262d1821e21aa75224e342d68
-
Size
291KB
-
Sample
211218-3f4qasffe6
-
MD5
cc7cc7ea9e6bd19de788db3c27b5ec98
-
SHA1
9ba15abdb490d5fb5f681ea7493d0e87f120531d
-
SHA256
299b283fe0e14bd9b33838858a4e6342d2000b5262d1821e21aa75224e342d68
-
SHA512
60f07b3b8809b75ca23a354d94c7f9c7b8b5b0c092c6e06d261c92e5fcca73a72e016a4116f069eadff8db52458b1b24225caa6405e728cdebd1b6c6dbcf2c67
Static task
static1
Behavioral task
behavioral1
Sample
299b283fe0e14bd9b33838858a4e6342d2000b5262d1821e21aa75224e342d68.exe
Resource
win10-en-20211208
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
1
86.107.197.138:38133
Extracted
redline
170
45.9.20.240:46257
Targets
-
-
Target
299b283fe0e14bd9b33838858a4e6342d2000b5262d1821e21aa75224e342d68
-
Size
291KB
-
MD5
cc7cc7ea9e6bd19de788db3c27b5ec98
-
SHA1
9ba15abdb490d5fb5f681ea7493d0e87f120531d
-
SHA256
299b283fe0e14bd9b33838858a4e6342d2000b5262d1821e21aa75224e342d68
-
SHA512
60f07b3b8809b75ca23a354d94c7f9c7b8b5b0c092c6e06d261c92e5fcca73a72e016a4116f069eadff8db52458b1b24225caa6405e728cdebd1b6c6dbcf2c67
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-