General
-
Target
abfb8689c686ad05177bd8064c528b0209c5882efde367ac71a5f4ef33312dd4
-
Size
212KB
-
Sample
221209-va4jcage3x
-
MD5
5d5b406afb0cf2c1b0fce77ac0cf95db
-
SHA1
190fad8962f7eb24f080893591e939684401cca5
-
SHA256
abfbe4e84fb976d6c3ed04e64428d0a8e27e515129fa7a54d15a05f6c23f12bf
-
SHA512
1d74ec34fc341e2394cc4587dd7e018a2d8d55a3a700dac2ce96a8cbad2dab0f0c6d1c1ffdde97595fbc6261ec91f17a1d6e9c723d293c92e60a13deadd48e8d
-
SSDEEP
6144:lv+coSesEU9g+Mj/swBVBhs78voiHxmaT0avsyD:lv+cdGVjO8Lb0gD
Static task
static1
Behavioral task
behavioral1
Sample
abfb8689c686ad05177bd8064c528b0209c5882efde367ac71a5f4ef33312dd4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
abfb8689c686ad05177bd8064c528b0209c5882efde367ac71a5f4ef33312dd4.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
amadey
3.50
31.41.244.237/jg94cVd30f/index.php
Extracted
redline
Nosh
31.41.244.186:4683
-
auth_value
b8a171b8f2a42502e350c6a85f0c8271
Extracted
redline
globaltrc20
185.106.92.214:2515
-
auth_value
e1205a807a50988797ccb9a0d99697af
Targets
-
-
Target
abfb8689c686ad05177bd8064c528b0209c5882efde367ac71a5f4ef33312dd4
-
Size
299KB
-
MD5
63e8126af2137e65f024aa542d2ac298
-
SHA1
d093a602a6abef3a48575eb740efe50c8f339410
-
SHA256
abfb8689c686ad05177bd8064c528b0209c5882efde367ac71a5f4ef33312dd4
-
SHA512
1a761d5cb263c1334d5e4626af608b856ce8a471713ead3479f49886798d5aadf9dfe7a67411f6914307f24f4739dfc446a3d9f938f0bf4d655eb5353f70bafc
-
SSDEEP
6144:NyzKoSesEU9geMj/swBlBhs78XeBAXXAaJyrVbXkDKi:NwKfGljO8OBOAWyrVb
-
Detect Amadey credential stealer module
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-