General
-
Target
f0c4e793957b0d1edd2408476e864fa88aac3253275a636524c69508c6ee4162
-
Size
185KB
-
Sample
221122-dy3hhsgh78
-
MD5
a5e6406eba902784501db05cbd2be89b
-
SHA1
1176ea0ecf2d9bebf5903c6a2856f916f3410484
-
SHA256
f0c4e793957b0d1edd2408476e864fa88aac3253275a636524c69508c6ee4162
-
SHA512
6c25db16ec83d1bca1dd3a1c8a2e7a33db9270031cfd97ad57d36a200b31e9c9f451f5d8a78b653eb4a9f22a28f7d8fc3f078d080e8630e5d2fc6c2c1285342a
-
SSDEEP
3072:Vln8NABxVWWNJcg5k5v81CNnH5B21bMX+hKKCUxPEuX/Xz:V9hffNUl8qUbMX+hKK5xPbP
Static task
static1
Malware Config
Extracted
redline
KRIPT
212.8.246.157:32348
-
auth_value
80ebe4bab7a98a7ce9c75989ff9f40b4
Extracted
amadey
3.50
193.56.146.174/g84kvj4jck/index.php
Targets
-
-
Target
f0c4e793957b0d1edd2408476e864fa88aac3253275a636524c69508c6ee4162
-
Size
185KB
-
MD5
a5e6406eba902784501db05cbd2be89b
-
SHA1
1176ea0ecf2d9bebf5903c6a2856f916f3410484
-
SHA256
f0c4e793957b0d1edd2408476e864fa88aac3253275a636524c69508c6ee4162
-
SHA512
6c25db16ec83d1bca1dd3a1c8a2e7a33db9270031cfd97ad57d36a200b31e9c9f451f5d8a78b653eb4a9f22a28f7d8fc3f078d080e8630e5d2fc6c2c1285342a
-
SSDEEP
3072:Vln8NABxVWWNJcg5k5v81CNnH5B21bMX+hKKCUxPEuX/Xz:V9hffNUl8qUbMX+hKK5xPbP
-
Detects Smokeloader packer
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-