General
-
Target
file.exe
-
Size
387KB
-
Sample
230322-3rp2aacb35
-
MD5
fb6012ff52a5243efefdd8983fdc3199
-
SHA1
b290ab1f6e065b38e75fd3808629c7764fe2615e
-
SHA256
ee15356d4e199b8a5d7ee0554a3cec7b8199a2f29b673a2e75668e0805cfac96
-
SHA512
88aac5da0e7bb5bef52fe6f5ef210816e9421a443af15e20d87a19c28467126242b21a130c3f8d191c22a3bc7c03063d818ae40dfc0c2ed038de3d5e29f0639f
-
SSDEEP
3072:/vxCChPnVZHQuxpK4RnPaPO9WpQ+G8zaOcFClw/TKQUh3pMa:L1VquvVnPhWjnuOcFa+KQUy
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Extracted
redline
fronx2
fronxtracking.com:80
-
auth_value
0a4100df2644a6a6582137d2da2c8bd1
Targets
-
-
Target
file.exe
-
Size
387KB
-
MD5
fb6012ff52a5243efefdd8983fdc3199
-
SHA1
b290ab1f6e065b38e75fd3808629c7764fe2615e
-
SHA256
ee15356d4e199b8a5d7ee0554a3cec7b8199a2f29b673a2e75668e0805cfac96
-
SHA512
88aac5da0e7bb5bef52fe6f5ef210816e9421a443af15e20d87a19c28467126242b21a130c3f8d191c22a3bc7c03063d818ae40dfc0c2ed038de3d5e29f0639f
-
SSDEEP
3072:/vxCChPnVZHQuxpK4RnPaPO9WpQ+G8zaOcFClw/TKQUh3pMa:L1VquvVnPhWjnuOcFa+KQUy
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-