General
-
Target
b96c950e4a8f8d3a21dbd453aacad4c98c2beaa519ea473cceb44e8e07840f47
-
Size
1.5MB
-
Sample
231101-qkva7sgg4y
-
MD5
a7dc7d825461e4c966c7b55334c51ce9
-
SHA1
9910aac5f0b037f743d3587c909e6ee0038967cc
-
SHA256
7aeda508ed08ec4db92d3e01caf7da7d817d9b34dfe3849e192d84afc16a415c
-
SHA512
5964594b2ca6a31f346c8a2184f2c715423fd1cbdd628916e0b48ab8f8fea51917f3aa9dd8789354afcf1dec42b4ee39c85f480cdd3dca4cc0b0c6dd14a4451c
-
SSDEEP
49152:qwaz5+VKRfhoS9jAYqjW5Ovr6KoQ2P6M5+b4R:laz5+Q1hoS9sDboTu4R
Static task
static1
Behavioral task
behavioral1
Sample
b96c950e4a8f8d3a21dbd453aacad4c98c2beaa519ea473cceb44e8e07840f47.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
http://yvzgz.cyou/index.php
https://yvzgz.cyou/index.php
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
kinza
77.91.124.86:19084
Extracted
redline
pixelnew
194.49.94.11:80
Extracted
raccoon
6a6a005b9aa778f606280c5fa24ae595
http://195.123.218.98:80
http://31.192.23
-
user_agent
SunShineMoonLight
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
redline
@ytlogsbot
194.169.175.235:42691
Targets
-
-
Target
b96c950e4a8f8d3a21dbd453aacad4c98c2beaa519ea473cceb44e8e07840f47
-
Size
1.5MB
-
MD5
91a05076a272443fd084758a41ae1386
-
SHA1
2fcff1f997d2f45686d196329c4d6559f55dc0f8
-
SHA256
b96c950e4a8f8d3a21dbd453aacad4c98c2beaa519ea473cceb44e8e07840f47
-
SHA512
419bb8e9578cda9a2201c4b101e7f05b1d4c8ee2c8b67ba8deba8a435408a5f609fb5b347e2d7146726ffa3d77d0384e3d3fe32b5e96158816f8d5f4455377b9
-
SSDEEP
49152:InMtORx/uSrjUiyDW5wDqKXgQkKACG918j4Pp:sMoD/uSrANrQtA4P
-
Detect ZGRat V1
-
Glupteba payload
-
Raccoon Stealer payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1