General
-
Target
59213ee608a0e6d9e9ee16a78773560ba024e9e94b587dce6ab488fea45eb212
-
Size
187KB
-
Sample
221124-yb8fgahe3x
-
MD5
4208d016a5bf97452217a88d6667b61d
-
SHA1
3b815ab9e7c714a17c5a8668aae8972abbe51aee
-
SHA256
59213ee608a0e6d9e9ee16a78773560ba024e9e94b587dce6ab488fea45eb212
-
SHA512
d30b805e981b90aaffcbe881034d3050508530f7401b1702a334b5bf44be285ad6f32ee2581519c90f1b797d5a51cd4dfa3f5c4e76af10e50c51effb6be8f759
-
SSDEEP
3072:cs2zBlK4xlBRTYvLJ8Q210mkl5bjrizb8l6CNWmRTPSrAy:mzHcL2Q2d0OzEF5PSr
Static task
static1
Behavioral task
behavioral1
Sample
59213ee608a0e6d9e9ee16a78773560ba024e9e94b587dce6ab488fea45eb212.exe
Resource
win10-20220901-en
Malware Config
Extracted
amadey
3.50
77.73.134.65/o7VsjdSa2f/index.php
Extracted
redline
KRIPT
212.8.246.157:32348
-
auth_value
80ebe4bab7a98a7ce9c75989ff9f40b4
Targets
-
-
Target
59213ee608a0e6d9e9ee16a78773560ba024e9e94b587dce6ab488fea45eb212
-
Size
187KB
-
MD5
4208d016a5bf97452217a88d6667b61d
-
SHA1
3b815ab9e7c714a17c5a8668aae8972abbe51aee
-
SHA256
59213ee608a0e6d9e9ee16a78773560ba024e9e94b587dce6ab488fea45eb212
-
SHA512
d30b805e981b90aaffcbe881034d3050508530f7401b1702a334b5bf44be285ad6f32ee2581519c90f1b797d5a51cd4dfa3f5c4e76af10e50c51effb6be8f759
-
SSDEEP
3072:cs2zBlK4xlBRTYvLJ8Q210mkl5bjrizb8l6CNWmRTPSrAy:mzHcL2Q2d0OzEF5PSr
-
Detect Amadey credential stealer module
-
Detects Smokeloader packer
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-