General
-
Target
dc131f02d7979e9e02a35a7587bc9ac98155140f7b005892d15916893abe5cbf
-
Size
201KB
-
Sample
220925-pelansfghl
-
MD5
8faff18da27adc323f7f6c0750c7fc6d
-
SHA1
659381f335e0df6068b484ae140f6d187a3260e9
-
SHA256
dc131f02d7979e9e02a35a7587bc9ac98155140f7b005892d15916893abe5cbf
-
SHA512
9112e2bd83941e4f4d3c7c5408939bbc1d4ad5140d43b6727ec93f9db7d32807043f4b6da72ac85aba11f71fd8436221ed6cf624682aec0d29ff19c04d6b355b
-
SSDEEP
3072:P3azNP1ZbUj5cAkddhTw/zh9O5y2DebVCqn8HbG8rdmB1nNOcaW/PkxXx:/Wakdd+/zh9cepCWebG8JW4
Static task
static1
Behavioral task
behavioral1
Sample
dc131f02d7979e9e02a35a7587bc9ac98155140f7b005892d15916893abe5cbf.exe
Resource
win10-20220901-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
dc131f02d7979e9e02a35a7587bc9ac98155140f7b005892d15916893abe5cbf
-
Size
201KB
-
MD5
8faff18da27adc323f7f6c0750c7fc6d
-
SHA1
659381f335e0df6068b484ae140f6d187a3260e9
-
SHA256
dc131f02d7979e9e02a35a7587bc9ac98155140f7b005892d15916893abe5cbf
-
SHA512
9112e2bd83941e4f4d3c7c5408939bbc1d4ad5140d43b6727ec93f9db7d32807043f4b6da72ac85aba11f71fd8436221ed6cf624682aec0d29ff19c04d6b355b
-
SSDEEP
3072:P3azNP1ZbUj5cAkddhTw/zh9O5y2DebVCqn8HbG8rdmB1nNOcaW/PkxXx:/Wakdd+/zh9cepCWebG8JW4
-
Detects Smokeloader packer
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
XMRig Miner payload
-
Creates new service(s)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-