General
-
Target
e02c27422d258451e589e008618887d4f37c72725d6ed2a30857de7b40643e0c
-
Size
240KB
-
Sample
230923-fpgwkaef82
-
MD5
ad87c6460d91e6f684bcd8df19e08890
-
SHA1
493f9a033189f8616aa761884e4287837aa95613
-
SHA256
e02c27422d258451e589e008618887d4f37c72725d6ed2a30857de7b40643e0c
-
SHA512
21f68b3bde4b3ea36b5033db6d77376e701b86b221ceb234b0756b40e09473e0187b9493533e024a3aff033dc990e54d8347104498679aafd9048a674d764ed8
-
SSDEEP
6144:Fp5frpxdonyq4zaG2u5AOYeKfGHAwrtWACuocbquqp:F/rp0/9u52eGFOdCCbquqp
Static task
static1
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
fabookie
http://app.nnnaajjjgc.com/check/safe
Targets
-
-
Target
e02c27422d258451e589e008618887d4f37c72725d6ed2a30857de7b40643e0c
-
Size
240KB
-
MD5
ad87c6460d91e6f684bcd8df19e08890
-
SHA1
493f9a033189f8616aa761884e4287837aa95613
-
SHA256
e02c27422d258451e589e008618887d4f37c72725d6ed2a30857de7b40643e0c
-
SHA512
21f68b3bde4b3ea36b5033db6d77376e701b86b221ceb234b0756b40e09473e0187b9493533e024a3aff033dc990e54d8347104498679aafd9048a674d764ed8
-
SSDEEP
6144:Fp5frpxdonyq4zaG2u5AOYeKfGHAwrtWACuocbquqp:F/rp0/9u52eGFOdCCbquqp
-
Detect Fabookie payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-