General
-
Target
00c8ffc1ade615e0b77bf9ad90f5d55770c243626e41dcd68e948c3742915df4
-
Size
147KB
-
Sample
221001-whsbqaadgr
-
MD5
9d1d5c4ad713a62aa923df3be73eb39c
-
SHA1
a9cfba2b758dd58ab10dc971176cdae1267f0b73
-
SHA256
00c8ffc1ade615e0b77bf9ad90f5d55770c243626e41dcd68e948c3742915df4
-
SHA512
d4bed992975902876d3620b5d2712d63f2b9445ae8851d9cdd965eae258db0f60885e1d0d0ff209bc33a8abcb08c9b157c635bf6ae8706f6600df32ff09d2186
-
SSDEEP
3072:ZPBhm4LNGRNZU14yX+v+IEKpGyDzSwHS:R/LKj9WMsyPSwy
Static task
static1
Behavioral task
behavioral1
Sample
00c8ffc1ade615e0b77bf9ad90f5d55770c243626e41dcd68e948c3742915df4.exe
Resource
win10-20220901-en
Malware Config
Extracted
redline
inslab26
185.182.194.25:8251
-
auth_value
7c9cbd0e489a3c7fd31006406cb96f5b
Targets
-
-
Target
00c8ffc1ade615e0b77bf9ad90f5d55770c243626e41dcd68e948c3742915df4
-
Size
147KB
-
MD5
9d1d5c4ad713a62aa923df3be73eb39c
-
SHA1
a9cfba2b758dd58ab10dc971176cdae1267f0b73
-
SHA256
00c8ffc1ade615e0b77bf9ad90f5d55770c243626e41dcd68e948c3742915df4
-
SHA512
d4bed992975902876d3620b5d2712d63f2b9445ae8851d9cdd965eae258db0f60885e1d0d0ff209bc33a8abcb08c9b157c635bf6ae8706f6600df32ff09d2186
-
SSDEEP
3072:ZPBhm4LNGRNZU14yX+v+IEKpGyDzSwHS:R/LKj9WMsyPSwy
-
Detects Smokeloader packer
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-