General
-
Target
e4124e0776e3b6d7f35e96c7fc666674c2485ac51d92914a1e5266d330e59360
-
Size
514KB
-
Sample
230718-rt355sbc25
-
MD5
9a63fbfe11cf52fc8609db042be9884d
-
SHA1
2f158ba82832992b5940ab9b95f260a4bd03070e
-
SHA256
e4124e0776e3b6d7f35e96c7fc666674c2485ac51d92914a1e5266d330e59360
-
SHA512
94c17483e542dad371eec99ebd5ffa02ae5b74979cdfe581414040d5a770333bfc354ccab938b9f26f25a896ae9c4ff3a88328fa7b809ebe44837c041c3b2480
-
SSDEEP
12288:PMrXy90c85lBl8RPMVzMXdnh8ESD67sx79ADjhuy/A:4ywlXVzUkzD67WeDjhumA
Static task
static1
Behavioral task
behavioral1
Sample
e4124e0776e3b6d7f35e96c7fc666674c2485ac51d92914a1e5266d330e59360.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.85
77.91.68.3/home/love/index.php
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
roma
77.91.68.56:19071
-
auth_value
f099c2cf92834dbc554a94e1456cf576
Targets
-
-
Target
e4124e0776e3b6d7f35e96c7fc666674c2485ac51d92914a1e5266d330e59360
-
Size
514KB
-
MD5
9a63fbfe11cf52fc8609db042be9884d
-
SHA1
2f158ba82832992b5940ab9b95f260a4bd03070e
-
SHA256
e4124e0776e3b6d7f35e96c7fc666674c2485ac51d92914a1e5266d330e59360
-
SHA512
94c17483e542dad371eec99ebd5ffa02ae5b74979cdfe581414040d5a770333bfc354ccab938b9f26f25a896ae9c4ff3a88328fa7b809ebe44837c041c3b2480
-
SSDEEP
12288:PMrXy90c85lBl8RPMVzMXdnh8ESD67sx79ADjhuy/A:4ywlXVzUkzD67WeDjhumA
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-