General
-
Target
20e20a063ad919eaa77ceb01959b0edfe00049f7cfd7667add04c76b67105c93
-
Size
3.4MB
-
Sample
220222-papgjagfb3
-
MD5
c8591fc4ae3ce875ea06fa65943732e1
-
SHA1
2840386fd7ac8186adc875c991cae9564223cb12
-
SHA256
20e20a063ad919eaa77ceb01959b0edfe00049f7cfd7667add04c76b67105c93
-
SHA512
ee49f067153af66495422fba6915b8a39c98ecebb72c9f2a8fe5d5524de79f5eb4df43c104938ca4cfefec2fc2d7e586f64569cd0fb16017fb57c32ce729129f
Static task
static1
Behavioral task
behavioral1
Sample
20e20a063ad919eaa77ceb01959b0edfe00049f7cfd7667add04c76b67105c93.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
20e20a063ad919eaa77ceb01959b0edfe00049f7cfd7667add04c76b67105c93.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
vidar
39.3
706
https://bandakere.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Extracted
redline
SV03
pupdatastar.tech:13994
pupdatastar.xyz:13994
pupdatastar.online:13994
Extracted
redline
Ani2
yaklalau.xyz:80
Targets
-
-
Target
20e20a063ad919eaa77ceb01959b0edfe00049f7cfd7667add04c76b67105c93
-
Size
3.4MB
-
MD5
c8591fc4ae3ce875ea06fa65943732e1
-
SHA1
2840386fd7ac8186adc875c991cae9564223cb12
-
SHA256
20e20a063ad919eaa77ceb01959b0edfe00049f7cfd7667add04c76b67105c93
-
SHA512
ee49f067153af66495422fba6915b8a39c98ecebb72c9f2a8fe5d5524de79f5eb4df43c104938ca4cfefec2fc2d7e586f64569cd0fb16017fb57c32ce729129f
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Vidar Stealer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-