General
-
Target
McAfee_Endpoint_Security_keygen_by_cat.zip
-
Size
7.9MB
-
Sample
221029-zye8wafhcm
-
MD5
232d59ab590adf17332804327fd7db3d
-
SHA1
0697a948c335ba270a29b7dc3142d55c93f8d06e
-
SHA256
ce8c9ba804375cddc78f41b5f6000c391da72fc7289193c28734537f3e998922
-
SHA512
f363fa17bf682d0fbd7cd658f64ce72619ec1d8d270c3483e847d6b125695f27d8a55200bee8e458f95fdbbb807f0f742eaab9de6f334c804a38fe228052bb42
-
SSDEEP
196608:nCQjIK3403mhXyKJA2A0Pn3QSngUBXK8rot/xjGMN8tm:qK340kXyK2YnXndzrotlUg
Static task
static1
Behavioral task
behavioral1
Sample
McAfee_Endpoint_Security_keygen_by_cat.exe
Resource
win10-20220812-en
Malware Config
Extracted
azorult
http://domcomp.info/1210776429.php
Extracted
redline
Eunewdomain1
hrabrlonian.xyz:81
-
auth_value
c7e61afc90a97addce2ecac4aaac2680
Targets
-
-
Target
McAfee_Endpoint_Security_keygen_by_cat.exe
-
Size
8.0MB
-
MD5
f83aa04c9dbbc1eefcecd14a99fa072d
-
SHA1
2c00d625e23a56a9b00dbf7177f681a5f91cc509
-
SHA256
17cc85f323fb5b3e36b10a46454fbd28cc38aaa06fb9ffb76c506af0f3552b71
-
SHA512
25e9251b4f0ac8747cfd90d615d3b617265cc94eb3587c3f933e31932b56f5548e3e18d3984541398600131bc1d97f9c71e1c59114508d474bd8605f21b77701
-
SSDEEP
196608:F4tdLtcLRki4dcI6dncKQigmast2kFUF9p+k7:yTRcLR94SDncygmaKnmd
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-