General
-
Target
28dfcf156ed2ac3a05ad4dc7dffc7b1d.exe
-
Size
1.7MB
-
Sample
230309-yrjgaabf7s
-
MD5
28dfcf156ed2ac3a05ad4dc7dffc7b1d
-
SHA1
80a3c0309c9976d7f4e12fa1d43f589a5e9bb4fc
-
SHA256
8771bd1aa86852d62474f9f811fad596dd7405c4b31e119c71d77413ce9b4035
-
SHA512
f4c87135c7b92ab76be07de36e4435ab03609243661d3e19c78e7f2faa825b7af0ff937d64063bd903ca0f45618629b1bb41df4c37368eeb477915e9ffe11238
-
SSDEEP
49152:sZzujF1mUmQW1CTB8/cRAfC30buKZYZRDDE7iQ8FfRJJegqrO4V:Iqbm/QW1CC/cRAs2a4V
Behavioral task
behavioral1
Sample
28dfcf156ed2ac3a05ad4dc7dffc7b1d.exe
Resource
win7-20230220-en
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
-
payload_urls
http://95.214.27.203:8080/upload/wrapper.exe
http://95.214.27.203:8080/upload/oigmre.exe,http://95.214.27.203:8080/upload/handler.exe
Extracted
redline
new1
85.31.46.182:12767
Targets
-
-
Target
28dfcf156ed2ac3a05ad4dc7dffc7b1d.exe
-
Size
1.7MB
-
MD5
28dfcf156ed2ac3a05ad4dc7dffc7b1d
-
SHA1
80a3c0309c9976d7f4e12fa1d43f589a5e9bb4fc
-
SHA256
8771bd1aa86852d62474f9f811fad596dd7405c4b31e119c71d77413ce9b4035
-
SHA512
f4c87135c7b92ab76be07de36e4435ab03609243661d3e19c78e7f2faa825b7af0ff937d64063bd903ca0f45618629b1bb41df4c37368eeb477915e9ffe11238
-
SSDEEP
49152:sZzujF1mUmQW1CTB8/cRAfC30buKZYZRDDE7iQ8FfRJJegqrO4V:Iqbm/QW1CC/cRAs2a4V
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-