General
-
Target
NEAS.00932b9632f5974d443534bede90eee0.exe
-
Size
1.2MB
-
Sample
231101-q5nn6ahb4y
-
MD5
00932b9632f5974d443534bede90eee0
-
SHA1
ae5883c30e44fd12e2171b999d883daa42bad07d
-
SHA256
627e46e4ca56bf4609adde5bc7649889d2eb4f8e678589428b976f885e3fc922
-
SHA512
9f931602425d966ea993463c11f2e7e78bede012a2bda2feca17801443e31fc2458c8e286f13ed13882f7cf3a625a90370b95c601fdb4886a6d0c3540b620f4b
-
SSDEEP
24576:MySwf0WQDu2FLeDsDgwGFw+lDqWRI+pIsFihhDQx3a6Vz8T:7RYj06vGbdIsFWNQx3pVz8
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.00932b9632f5974d443534bede90eee0.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
kinza
77.91.124.86:19084
Targets
-
-
Target
NEAS.00932b9632f5974d443534bede90eee0.exe
-
Size
1.2MB
-
MD5
00932b9632f5974d443534bede90eee0
-
SHA1
ae5883c30e44fd12e2171b999d883daa42bad07d
-
SHA256
627e46e4ca56bf4609adde5bc7649889d2eb4f8e678589428b976f885e3fc922
-
SHA512
9f931602425d966ea993463c11f2e7e78bede012a2bda2feca17801443e31fc2458c8e286f13ed13882f7cf3a625a90370b95c601fdb4886a6d0c3540b620f4b
-
SSDEEP
24576:MySwf0WQDu2FLeDsDgwGFw+lDqWRI+pIsFihhDQx3a6Vz8T:7RYj06vGbdIsFWNQx3pVz8
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1