General
-
Target
d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4
-
Size
164KB
-
Sample
230715-gamzpsaa3y
-
MD5
68c573fc5f6647bc3a99c61b71feb157
-
SHA1
532ffd3c01cdf042d281aaf623728cc6906ad718
-
SHA256
d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4
-
SHA512
7e14a84f09c36d5f8495533d820587b537d3cb4502f38df2dfbc3b2ae0f52d499737327f24a71c268b78bb2154cf040b686af04b834ccbcc0a7c9aa20ebc7449
-
SSDEEP
3072:4haLyj6NixNybTR+XhW3CC34UJfwuQwkVwpsxVNU5A5Tt:/LyeNiSHkXhs4QwRwVUVH5x
Static task
static1
Behavioral task
behavioral1
Sample
d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4.exe
Resource
win10-20230703-en
Malware Config
Extracted
smokeloader
summ
Extracted
smokeloader
2022
http://stalagmijesarl.com/
http://ukdantist-sarl.com/
http://cpcorprotationltd.com/
Extracted
lumma
gstatic-node.io
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Targets
-
-
Target
d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4
-
Size
164KB
-
MD5
68c573fc5f6647bc3a99c61b71feb157
-
SHA1
532ffd3c01cdf042d281aaf623728cc6906ad718
-
SHA256
d0baa169452f90607555259a3857499463edf2981de2b982c1624e407e23e6f4
-
SHA512
7e14a84f09c36d5f8495533d820587b537d3cb4502f38df2dfbc3b2ae0f52d499737327f24a71c268b78bb2154cf040b686af04b834ccbcc0a7c9aa20ebc7449
-
SSDEEP
3072:4haLyj6NixNybTR+XhW3CC34UJfwuQwkVwpsxVNU5A5Tt:/LyeNiSHkXhs4QwRwVUVH5x
-
Detect rhadamanthys stealer shellcode
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies boot configuration data using bcdedit
-
Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-