General
-
Target
file
-
Size
248KB
-
Sample
230323-d8cd3sdc84
-
MD5
914c46a92fe166deb30650ec83f189d1
-
SHA1
c6b51b4364064ac1296e118b8c3bbb24f5437df6
-
SHA256
ee0bc4bb3398ba5214bdef3b94bc5bc5eaba5d611e0c71e8cdcaf36e574b90ab
-
SHA512
9f50ec019a86062c99484092872ef4174f12877d86d87433883dc11ab565376f8f6f398febc7808cd8fc587d104a5e9fcaf886013568dd2f0fdeda4767df7f94
-
SSDEEP
3072:KjFaCOpFJdYgCrNEyO3VVU+2iTlRY8nL4OpvF0fPl+uE9f/bn3UAMa:TXJd0NaZZUu8OpGfP8uE9Xgt
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Extracted
redline
fronx2
fronxtracking.com:80
-
auth_value
0a4100df2644a6a6582137d2da2c8bd1
Targets
-
-
Target
file
-
Size
248KB
-
MD5
914c46a92fe166deb30650ec83f189d1
-
SHA1
c6b51b4364064ac1296e118b8c3bbb24f5437df6
-
SHA256
ee0bc4bb3398ba5214bdef3b94bc5bc5eaba5d611e0c71e8cdcaf36e574b90ab
-
SHA512
9f50ec019a86062c99484092872ef4174f12877d86d87433883dc11ab565376f8f6f398febc7808cd8fc587d104a5e9fcaf886013568dd2f0fdeda4767df7f94
-
SSDEEP
3072:KjFaCOpFJdYgCrNEyO3VVU+2iTlRY8nL4OpvF0fPl+uE9f/bn3UAMa:TXJd0NaZZUu8OpGfP8uE9Xgt
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-