General
-
Target
5f7a572476567cdf33d18f3ed37f794bb29f451f5ade5002950c340d84ec55b3
-
Size
246KB
-
Sample
221109-y1lm1abgg2
-
MD5
ca8e3a2f258ec35f4530d97e42accbba
-
SHA1
c8304bd04c0574c12ee6de3f2a5319842ab38de9
-
SHA256
5f7a572476567cdf33d18f3ed37f794bb29f451f5ade5002950c340d84ec55b3
-
SHA512
78307de48b487c033f8d71f75fa0770916404cd97c1dbef348c0a0b85fe4daeeb3b688ffba8a9e00930ed294656c9c28aa706096367c796dbb29a83bf2af45f1
-
SSDEEP
6144:iQ+EkoLNtn0bBZkIuBf0D88gq/yUJSvo:ixoxtnMBZk5Bfa8fw
Static task
static1
Behavioral task
behavioral1
Sample
5f7a572476567cdf33d18f3ed37f794bb29f451f5ade5002950c340d84ec55b3.exe
Resource
win10-20220812-en
Malware Config
Extracted
redline
45.15.156.37:110
157.90.145.151:14075
-
auth_value
19cd76dae6d01d9649fd29624fa61e51
Extracted
redline
mao
77.73.134.251:4691
-
auth_value
a06897b11f5e600c4479f1b544acc337
Extracted
redline
@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)
151.80.89.233:13553
-
auth_value
fbee175162920530e6bf470c8003fa1a
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
-
payload_urls
https://raroford3242.xyz/myupdate.exe
https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe
https://raroford3242.xyz/myupdate.exe
https://raroford3242.xyz/myupdate.exe
Extracted
raccoon
bf3346f8b90a3b56b998fed7451ba685
http://87.236.161.20/
Targets
-
-
Target
5f7a572476567cdf33d18f3ed37f794bb29f451f5ade5002950c340d84ec55b3
-
Size
246KB
-
MD5
ca8e3a2f258ec35f4530d97e42accbba
-
SHA1
c8304bd04c0574c12ee6de3f2a5319842ab38de9
-
SHA256
5f7a572476567cdf33d18f3ed37f794bb29f451f5ade5002950c340d84ec55b3
-
SHA512
78307de48b487c033f8d71f75fa0770916404cd97c1dbef348c0a0b85fe4daeeb3b688ffba8a9e00930ed294656c9c28aa706096367c796dbb29a83bf2af45f1
-
SSDEEP
6144:iQ+EkoLNtn0bBZkIuBf0D88gq/yUJSvo:ixoxtnMBZk5Bfa8fw
-
Detect Amadey credential stealer module
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-