General
-
Target
d84550df7a55ed30270474ec3a55536338374e29dea52534f02321897abd154c
-
Size
291KB
-
Sample
211219-ewjhasfgh9
-
MD5
7ee16eb07c5680d63db858d5c540bec6
-
SHA1
7fd0fe77bbc0da26b1b7531616e915ee5521bf1d
-
SHA256
d84550df7a55ed30270474ec3a55536338374e29dea52534f02321897abd154c
-
SHA512
41741e85cf3a6ca56c3e3cb8c0b9aacd2555555245f9d63ce8ca729708d9ab69738bad488212ac8849fc19ac2db3cb7b5fbf08a2c45e2497a1f461585565de1f
Static task
static1
Behavioral task
behavioral1
Sample
d84550df7a55ed30270474ec3a55536338374e29dea52534f02321897abd154c.exe
Resource
win10-en-20211208
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
1
86.107.197.138:38133
Extracted
redline
170
45.9.20.240:46257
Extracted
raccoon
0efc785fd840be1c87bf9a41a244f3fae2a1e3c8
-
url4cnc
http://194.180.174.53/azbukaabc1
http://91.219.236.18/azbukaabc1
http://194.180.174.41/azbukaabc1
http://91.219.236.148/azbukaabc1
Targets
-
-
Target
d84550df7a55ed30270474ec3a55536338374e29dea52534f02321897abd154c
-
Size
291KB
-
MD5
7ee16eb07c5680d63db858d5c540bec6
-
SHA1
7fd0fe77bbc0da26b1b7531616e915ee5521bf1d
-
SHA256
d84550df7a55ed30270474ec3a55536338374e29dea52534f02321897abd154c
-
SHA512
41741e85cf3a6ca56c3e3cb8c0b9aacd2555555245f9d63ce8ca729708d9ab69738bad488212ac8849fc19ac2db3cb7b5fbf08a2c45e2497a1f461585565de1f
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-