General
-
Target
e48396be322c4b53b6276840defddfdb43683483b970693aca3094d70e880fde
-
Size
271KB
-
Sample
221116-ts598aga2t
-
MD5
6cdfa88eff4478bd56fd8dd9527be159
-
SHA1
7a44008ef8e7341d93d9d9fa3a85abcd156542ce
-
SHA256
e48396be322c4b53b6276840defddfdb43683483b970693aca3094d70e880fde
-
SHA512
155ace65e478dab138ca8aa82ff3a0f426ad2153340ee8e21050835416c6f4fb9bf3e90311bf0b95d245d981c966bb1a7a0b7d735339e300f1fdaa5c1010aea6
-
SSDEEP
6144:1HuaL08TOjDBj+gobRDJRkrWqKLFqKEjoEsJF1:13Q6OjD8gQkrWqgqKQkL
Static task
static1
Behavioral task
behavioral1
Sample
e48396be322c4b53b6276840defddfdb43683483b970693aca3094d70e880fde.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
redline
@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)
151.80.89.233:13553
-
auth_value
fbee175162920530e6bf470c8003fa1a
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
Extracted
raccoon
dbffbdbc9786a5c270e6dd2d647e18ea
http://79.137.205.87/
Targets
-
-
Target
e48396be322c4b53b6276840defddfdb43683483b970693aca3094d70e880fde
-
Size
271KB
-
MD5
6cdfa88eff4478bd56fd8dd9527be159
-
SHA1
7a44008ef8e7341d93d9d9fa3a85abcd156542ce
-
SHA256
e48396be322c4b53b6276840defddfdb43683483b970693aca3094d70e880fde
-
SHA512
155ace65e478dab138ca8aa82ff3a0f426ad2153340ee8e21050835416c6f4fb9bf3e90311bf0b95d245d981c966bb1a7a0b7d735339e300f1fdaa5c1010aea6
-
SSDEEP
6144:1HuaL08TOjDBj+gobRDJRkrWqKLFqKEjoEsJF1:13Q6OjD8gQkrWqgqKQkL
-
Detect Amadey credential stealer module
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-