General
-
Target
038789d6cef36f7c28a3131c0bf3dff5.exe
-
Size
1.7MB
-
Sample
230309-zbbbeaab67
-
MD5
038789d6cef36f7c28a3131c0bf3dff5
-
SHA1
f1d1523f31df0c6c36234692de3c5ead577e9578
-
SHA256
5d007b2e9db06688735624bd49cbf01853685fbbb872e98173e87c07bd5f4533
-
SHA512
a8b7f2e60904693c9f9b0499d21d653cef8fc82058d8d68ed40692508b25a952ac6505cdade7205f819a2e8f60de0230db2c235329bbb468f3f4536de3353951
-
SSDEEP
24576:21H1ulUSNugkX6i1v0qNka1R1EUymL+95IekCoVvfxm9C64XZV:23uKL6Cka6SMo14obX
Behavioral task
behavioral1
Sample
038789d6cef36f7c28a3131c0bf3dff5.exe
Resource
win7-20230220-en
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
-
payload_urls
http://95.214.27.203:8080/upload/wrapper.exe
http://95.214.27.203:8080/upload/oigmre.exe,http://95.214.27.203:8080/upload/handler.exe
Extracted
redline
new1
85.31.46.182:12767
Targets
-
-
Target
038789d6cef36f7c28a3131c0bf3dff5.exe
-
Size
1.7MB
-
MD5
038789d6cef36f7c28a3131c0bf3dff5
-
SHA1
f1d1523f31df0c6c36234692de3c5ead577e9578
-
SHA256
5d007b2e9db06688735624bd49cbf01853685fbbb872e98173e87c07bd5f4533
-
SHA512
a8b7f2e60904693c9f9b0499d21d653cef8fc82058d8d68ed40692508b25a952ac6505cdade7205f819a2e8f60de0230db2c235329bbb468f3f4536de3353951
-
SSDEEP
24576:21H1ulUSNugkX6i1v0qNka1R1EUymL+95IekCoVvfxm9C64XZV:23uKL6Cka6SMo14obX
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-