General
-
Target
NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe
-
Size
1.1MB
-
Sample
231008-ta4cxadh3w
-
MD5
296f35d62c2257cd413d51f024c75a1c
-
SHA1
e82beb9695d098dffce98113c13b740cfdc3ff89
-
SHA256
94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3
-
SHA512
7768057079208dd928355e407f88ae42755a9bd44dffc110bec36ea436f5b7e7d350f1dd481e7ca6459e68114203988091460cf53092a6e4643a16421bc43d42
-
SSDEEP
24576:OyxDRxeJHNtApa0ti0Th+01D6FhmtuIjqCn34j+qBr2EtNFQZ:dnxelNtApxi0Th+Ughmk/Cn3WJIEbF
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
redline
frant
77.91.124.55:19071
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
magia
77.91.124.55:19071
Extracted
amadey
3.83
http://5.42.65.80/8bmeVwqx/index.php
-
install_dir
207aa4515d
-
install_file
oneetx.exe
-
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4
Extracted
redline
lutyr
77.91.124.55:19071
Targets
-
-
Target
NEAS.94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3exe_JC.exe
-
Size
1.1MB
-
MD5
296f35d62c2257cd413d51f024c75a1c
-
SHA1
e82beb9695d098dffce98113c13b740cfdc3ff89
-
SHA256
94a52b41541782be436394203e3aca5b5fbea27a912766ffd07cddf66557c1e3
-
SHA512
7768057079208dd928355e407f88ae42755a9bd44dffc110bec36ea436f5b7e7d350f1dd481e7ca6459e68114203988091460cf53092a6e4643a16421bc43d42
-
SSDEEP
24576:OyxDRxeJHNtApa0ti0Th+01D6FhmtuIjqCn34j+qBr2EtNFQZ:dnxelNtApxi0Th+Ughmk/Cn3WJIEbF
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Mystic stealer payload
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1