General
-
Target
a851f884ed7ca8024972249e3de801536886a6fc0f93aea5d8a9fe26f62423da
-
Size
152KB
-
Sample
220926-lyzevsbefp
-
MD5
ce73ae919b9a3c2887ade6d273679d48
-
SHA1
2765b6d1fc9e49b439fc0f954724daa45f7e6cf0
-
SHA256
a851f884ed7ca8024972249e3de801536886a6fc0f93aea5d8a9fe26f62423da
-
SHA512
de857d6bf5a403ad2251573eb548104a3ce82d480da0d19025cc399d02206c9a9917f3e4479685f1282edc84941119b0f05bea7627d801e356e00be57a77f92f
-
SSDEEP
3072:tkNR0Pfz5Jx21nzXWPXV+wpAizog/Br77n5B:KCzx21zXWPXV+wpARgV
Static task
static1
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Extracted
redline
insmix
jamesmillion2.xyz:9420
-
auth_value
f388a05524f756108c9e4b0f4c4bafb6
Targets
-
-
Target
a851f884ed7ca8024972249e3de801536886a6fc0f93aea5d8a9fe26f62423da
-
Size
152KB
-
MD5
ce73ae919b9a3c2887ade6d273679d48
-
SHA1
2765b6d1fc9e49b439fc0f954724daa45f7e6cf0
-
SHA256
a851f884ed7ca8024972249e3de801536886a6fc0f93aea5d8a9fe26f62423da
-
SHA512
de857d6bf5a403ad2251573eb548104a3ce82d480da0d19025cc399d02206c9a9917f3e4479685f1282edc84941119b0f05bea7627d801e356e00be57a77f92f
-
SSDEEP
3072:tkNR0Pfz5Jx21nzXWPXV+wpAizog/Br77n5B:KCzx21zXWPXV+wpARgV
-
Detects Smokeloader packer
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-