General
-
Target
affb629af9de8ff0c78c3feaf7b81108.exe
-
Size
270KB
-
Sample
230401-bz81ksgd51
-
MD5
affb629af9de8ff0c78c3feaf7b81108
-
SHA1
a84cabf3aa2b6542e57a101f94f8ea0ea548a91b
-
SHA256
aca2368fa225fda4ea1d223ac914bf42ee81884dbe97536b832fb3706ca6ac1f
-
SHA512
f690f355b7e1e50ab82502009b98d054d5938fc9ff06918cf868ae3f10308a89b101b987655f9ed83dace43dd790d93d4792ac3a0fbac61614822c07d6f9b0a8
-
SSDEEP
3072:8cgSq3amsUo24elcTlq1Scfubj8X6MlC5MX6Gw+TDqYI:XqK5J2ONf8XVlC5MT
Static task
static1
Behavioral task
behavioral1
Sample
affb629af9de8ff0c78c3feaf7b81108.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
affb629af9de8ff0c78c3feaf7b81108.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Extracted
redline
vip
176.123.9.142:14845
-
auth_value
04988fae39606b9c65a0cc86dfa46c41
Extracted
aurora
94.142.138.30:8081
Targets
-
-
Target
affb629af9de8ff0c78c3feaf7b81108.exe
-
Size
270KB
-
MD5
affb629af9de8ff0c78c3feaf7b81108
-
SHA1
a84cabf3aa2b6542e57a101f94f8ea0ea548a91b
-
SHA256
aca2368fa225fda4ea1d223ac914bf42ee81884dbe97536b832fb3706ca6ac1f
-
SHA512
f690f355b7e1e50ab82502009b98d054d5938fc9ff06918cf868ae3f10308a89b101b987655f9ed83dace43dd790d93d4792ac3a0fbac61614822c07d6f9b0a8
-
SSDEEP
3072:8cgSq3amsUo24elcTlq1Scfubj8X6MlC5MX6Gw+TDqYI:XqK5J2ONf8XVlC5MT
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-