General
-
Target
02d145847cb4053180305a7ee1e3ece5.exe
-
Size
451KB
-
Sample
230309-xbrmaabd3x
-
MD5
02d145847cb4053180305a7ee1e3ece5
-
SHA1
75d954af6b2b5cbe0de7a98dff5cc5200cb02542
-
SHA256
d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6
-
SHA512
f88dd7a40534e1e9fc8f5f2fae1824af4caa6696b90739c080dba2a3293e5a4430aea27e2a2558f2fae4cb94168a50406f1bcb9bc00aab80fa2c4ff83d282897
-
SSDEEP
12288:sFavSOXNrtNxp/QTIboxj1JUWUncVlkOBapx39PoxfMDUUUUUmgUUUUUU9UUUUUv:dv79rbxpkI0iRK
Behavioral task
behavioral1
Sample
02d145847cb4053180305a7ee1e3ece5.exe
Resource
win7-20230220-en
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
-
payload_urls
http://95.214.27.203:8080/upload/wrapper.exe
http://95.214.27.203:8080/upload/oigmre.exe,http://95.214.27.203:8080/upload/handler.exe
Extracted
redline
new1
85.31.46.182:12767
Targets
-
-
Target
02d145847cb4053180305a7ee1e3ece5.exe
-
Size
451KB
-
MD5
02d145847cb4053180305a7ee1e3ece5
-
SHA1
75d954af6b2b5cbe0de7a98dff5cc5200cb02542
-
SHA256
d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6
-
SHA512
f88dd7a40534e1e9fc8f5f2fae1824af4caa6696b90739c080dba2a3293e5a4430aea27e2a2558f2fae4cb94168a50406f1bcb9bc00aab80fa2c4ff83d282897
-
SSDEEP
12288:sFavSOXNrtNxp/QTIboxj1JUWUncVlkOBapx39PoxfMDUUUUUmgUUUUUU9UUUUUv:dv79rbxpkI0iRK
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-