General
-
Target
de10d806629305412bd27263c584a7befdaf59e89635bb9b018466d90aa6319e
-
Size
3.4MB
-
Sample
220314-baltradcak
-
MD5
be06c4b6d695449f79bc975f4366dd7e
-
SHA1
942069a45e65f78be513ef89e01533ab83abaf02
-
SHA256
de10d806629305412bd27263c584a7befdaf59e89635bb9b018466d90aa6319e
-
SHA512
c148be5a56856aa858b2b7783d7df3df5e882168e6b6895fd6a1a91b4e5db9279ace2518025bc343bda210aaf0a2b8cfe62027be2cd693d9806a1c9eebda9319
Static task
static1
Behavioral task
behavioral1
Sample
de10d806629305412bd27263c584a7befdaf59e89635bb9b018466d90aa6319e.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
de10d806629305412bd27263c584a7befdaf59e89635bb9b018466d90aa6319e.exe
Resource
win10v2004-20220310-en
Malware Config
Extracted
vidar
39.3
706
https://bandakere.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Extracted
redline
Ani
zetarnoria.xyz:80
Targets
-
-
Target
de10d806629305412bd27263c584a7befdaf59e89635bb9b018466d90aa6319e
-
Size
3.4MB
-
MD5
be06c4b6d695449f79bc975f4366dd7e
-
SHA1
942069a45e65f78be513ef89e01533ab83abaf02
-
SHA256
de10d806629305412bd27263c584a7befdaf59e89635bb9b018466d90aa6319e
-
SHA512
c148be5a56856aa858b2b7783d7df3df5e882168e6b6895fd6a1a91b4e5db9279ace2518025bc343bda210aaf0a2b8cfe62027be2cd693d9806a1c9eebda9319
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload
-
Vidar Stealer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-