General
-
Target
99e4bc849c500f4d00f508717452fbda.bin
-
Size
1.5MB
-
Sample
231102-cyr64shb79
-
MD5
df93c766c12a8f25f37acbabf857df34
-
SHA1
49716416f48f657ab53f6372c51c78bb0882f58c
-
SHA256
24d102ff59de21c5093018d6e63eb48bd5a63e0c89c6807fdd8b5fdff21b7678
-
SHA512
9b3ddb26b62f71076fdeb8466bf7daa5ffe24c9f7207400aba11702dade6cdc07b051b9323033283cbba75eace7e3e8cdb9b9faa69ed49ae75477f6d9d4ea912
-
SSDEEP
49152:hDMWkb3+nncwGrvDTcq+dDPUMshvNIkgRab:hQR3QcwGrvfcLhw19gY
Static task
static1
Behavioral task
behavioral1
Sample
60666e296e627bfa30fcb125abb42da679f5c4c088842214edfa573b009621a7.exe
Resource
win10v2004-20231025-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
plost
77.91.124.86:19084
Extracted
redline
kedru
77.91.124.86:19084
Targets
-
-
Target
60666e296e627bfa30fcb125abb42da679f5c4c088842214edfa573b009621a7.exe
-
Size
1.5MB
-
MD5
99e4bc849c500f4d00f508717452fbda
-
SHA1
a310587385d241d5ae116a4dd167b351ce06d6d8
-
SHA256
60666e296e627bfa30fcb125abb42da679f5c4c088842214edfa573b009621a7
-
SHA512
e3fec1aa9e8c4a0c5c24d2b94b08802d33fc3462c8b3483c215f8a656274eb6da308db333a1eb694f854f09feb4742076da477c05427f97fd0c695594980687e
-
SSDEEP
24576:xyX0+kGqYzhEjPcBFNLWnmO7GdXTvEVbfS6nzMP+0ZSwcaN3CL24:kDkhYzicBFNLWqjkRQP+spV3
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1