General
-
Target
1559306d477b0a6860ed46671ed1c105640ceff771be5ca22c4830f2d6f47ed9
-
Size
239KB
-
Sample
230923-pq3n4ahc56
-
MD5
5f713f5e2341c87b45ba316c5f8273ac
-
SHA1
65daaededc7cb5239c01da96a38209785acdc195
-
SHA256
1559306d477b0a6860ed46671ed1c105640ceff771be5ca22c4830f2d6f47ed9
-
SHA512
c24f1fb4f54ae7a16f06b24eb8da0365ee71cef3bf737b85b6445352b64f07766cd4c4f18b7b961dda06a4b732779cc7ce1924c75c439d5458251aaf3ee431c7
-
SSDEEP
6144:ZP46fuYXChoQTjlFgLuCY1dRuAOnnCpGyCyqjdw8y0:ZgYzXChdTbv1bu5hyCXZw8y
Static task
static1
Behavioral task
behavioral1
Sample
1559306d477b0a6860ed46671ed1c105640ceff771be5ca22c4830f2d6f47ed9.exe
Resource
win10-20230915-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Targets
-
-
Target
1559306d477b0a6860ed46671ed1c105640ceff771be5ca22c4830f2d6f47ed9
-
Size
239KB
-
MD5
5f713f5e2341c87b45ba316c5f8273ac
-
SHA1
65daaededc7cb5239c01da96a38209785acdc195
-
SHA256
1559306d477b0a6860ed46671ed1c105640ceff771be5ca22c4830f2d6f47ed9
-
SHA512
c24f1fb4f54ae7a16f06b24eb8da0365ee71cef3bf737b85b6445352b64f07766cd4c4f18b7b961dda06a4b732779cc7ce1924c75c439d5458251aaf3ee431c7
-
SSDEEP
6144:ZP46fuYXChoQTjlFgLuCY1dRuAOnnCpGyCyqjdw8y0:ZgYzXChdTbv1bu5hyCXZw8y
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-