General
-
Target
Inv_7623980.exe
-
Size
586KB
-
Sample
230508-srh8mabd25
-
MD5
2ef885be5c86fcf9756dda5ccb8c5dfd
-
SHA1
948a20b9670c53f52ccbe403d22e0819588a7ca4
-
SHA256
6982ab1d029213bfcfbc542eee0d955b770f5c0df083dc94463c441e2de35fe5
-
SHA512
dddf5f081da4803e58141819edf3247bb4b1b86ec3b0da7a152a9b35ad8c8b41efc829f1fe28e4e88b60264c7357b001a08ed32326f6013359f872e2d4f9160e
-
SSDEEP
12288:g8IV8Rjz8dXwXClmNIHbvDgKe5Ul9eYxvE:d+an8dXwXCbA75g9eYxc
Static task
static1
Behavioral task
behavioral1
Sample
Inv_7623980.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
Inv_7623980.exe
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
Inv_7623980.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
formbook
4.1
m82
jamesdevereux.com
artificialturfminneapolis.com
hongmeiyan.com
lojaderoupasbr.com
yit.africa
austinrelocationexpert.com
saiva.page
exitsategy.com
chochonux.com
klosterbraeu-unterliezheim.com
byseymanur.com
sblwarwickshire.co.uk
brazimaid.com
ciogame.com
bronzesailing.com
dwkapl.xyz
022dyd.com
compassandpathwriting.com
alphabet1x.com
selfcleaninghairbrush.co.uk
power-bank.co.uk
kickskaart.com
baumanbilliardsnv.com
bestcp.net
doghospitalnearme.com
mixano.africa
helarybaber.online
illubio.com
ciutas.com
ldpr33.ru
killtheblacks.com
cassino-portugal.com
danhaii.com
gvtowingservice.com
let-travel.africa
dental-implants-67128.com
facetaxi.xyz
ctjh9u8e.vip
kyosaiohruri.com
executivepresencetrainer.com
greatharmony.africa
feelingsarereal.com
devopsuday.club
happiestminds-udemy.com
fittingstands.com
happyhousegarment.com
24daysofheaven.com
herhustlenation.com
xn--oy2b27nt6b.net
hothotcogixem.online
hausmeisterservice-berlin.net
hjddbb.com
stoutfamilychiro.com
bookishthoughtsbychristy.com
gibellinaheartquake.com
8cf1utrb6.xyz
patrick-daggitt.com
ebcbank.net
angel909reviews.com
arcteryxsouthafricaonline.com
cutematvhy.com
art2z.com
bulkforeverstamps.com
heatbling.com
despachocontablequinsa.com
Targets
-
-
Target
Inv_7623980.exe
-
Size
586KB
-
MD5
2ef885be5c86fcf9756dda5ccb8c5dfd
-
SHA1
948a20b9670c53f52ccbe403d22e0819588a7ca4
-
SHA256
6982ab1d029213bfcfbc542eee0d955b770f5c0df083dc94463c441e2de35fe5
-
SHA512
dddf5f081da4803e58141819edf3247bb4b1b86ec3b0da7a152a9b35ad8c8b41efc829f1fe28e4e88b60264c7357b001a08ed32326f6013359f872e2d4f9160e
-
SSDEEP
12288:g8IV8Rjz8dXwXClmNIHbvDgKe5Ul9eYxvE:d+an8dXwXCbA75g9eYxc
-
Detects Redline Stealer samples
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-