General
-
Target
d64ea5e27b782f966b1805b93f35163741e8133c1e6d9fb4e5e47b547f3041e3
-
Size
239KB
-
Sample
230924-ay3xhach39
-
MD5
22f6613e932b49f2731d87b9cc8d2037
-
SHA1
3802a5963610e38a044fe6eae27de6a9f4f850be
-
SHA256
d64ea5e27b782f966b1805b93f35163741e8133c1e6d9fb4e5e47b547f3041e3
-
SHA512
5aceafee94bb33471a144dfc0c178b44a70a269ec9082ff184ff76ac72eb3f35e32f9e4bcf23382bbee0749ebbb2f61dfd982a7d21fafcdc4a6c56610d4e8f90
-
SSDEEP
6144:Tn46fuYXChoQTjlFgLuCY1dRuAO9Podr+5iIw8y0:T4YzXChdTbv1bu7ol7Iw8y
Static task
static1
Behavioral task
behavioral1
Sample
d64ea5e27b782f966b1805b93f35163741e8133c1e6d9fb4e5e47b547f3041e3.exe
Resource
win10-20230915-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
fabookie
http://app.nnnaajjjgc.com/check/safe
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Targets
-
-
Target
d64ea5e27b782f966b1805b93f35163741e8133c1e6d9fb4e5e47b547f3041e3
-
Size
239KB
-
MD5
22f6613e932b49f2731d87b9cc8d2037
-
SHA1
3802a5963610e38a044fe6eae27de6a9f4f850be
-
SHA256
d64ea5e27b782f966b1805b93f35163741e8133c1e6d9fb4e5e47b547f3041e3
-
SHA512
5aceafee94bb33471a144dfc0c178b44a70a269ec9082ff184ff76ac72eb3f35e32f9e4bcf23382bbee0749ebbb2f61dfd982a7d21fafcdc4a6c56610d4e8f90
-
SSDEEP
6144:Tn46fuYXChoQTjlFgLuCY1dRuAO9Podr+5iIw8y0:T4YzXChdTbv1bu7ol7Iw8y
-
Detect Fabookie payload
-
Detect rhadamanthys stealer shellcode
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-