General
-
Target
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
Size
180KB
-
Sample
221127-1t6qpsbg59
-
MD5
5f20ef56c9b8c1e7c8fa9d58179287c1
-
SHA1
af8eb5785c9d06efdefe09957b2e64756c89dd85
-
SHA256
66c8cd5d95c5ea9b00046236da94e3c31b7e75d1096ff8adb18192876734becb
-
SHA512
fa03d34e1632f7df1786692a9a7e0f16ae3fb1233b0522d89fce05be12111257ac8ace20befb279ac682e7b279bbd824d2ce13fcb303611242f3b225ac49ab22
-
SSDEEP
3072:zAi2QTiMPMGLc8Kt7kFSHFaBeQTAYA3IBDWyBQjFFOeIY65FyjwWq:sPQTiQZrKt7kFSCTBA3IkBjFsg6DNh
Static task
static1
Behavioral task
behavioral1
Sample
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
amadey
3.50
193.56.146.194/h49vlBP/index.php
Extracted
redline
NewYear2023
185.106.92.111:2510
-
auth_value
99e9bde3b38509ea98c3316cc27e6106
Extracted
laplas
clipper.guru
-
api_key
ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb
Targets
-
-
Target
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
Size
237KB
-
MD5
56ea74271bbecfd918a3fc9c8bbc4b78
-
SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571
-
SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4
-
SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1
-
SSDEEP
3072:0+2N06qhEjfT8d5DW7ilAaBeQtAYA3IBDWyBQj8ydRQUWlUFenKomY:RXEjfToWuHtBA3IkBj7PWlUKKfY
-
Detect Amadey credential stealer module
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-