General
-
Target
0x000600000001ac45-52.dat
-
Size
38KB
-
Sample
231129-sh37fahc33
-
MD5
cb357a30e6e1350f4da4cbd44499fbae
-
SHA1
ab0538e676f32fa42d9d01d494c155da7568256e
-
SHA256
f7239524fdc6dc33d49c5087a436da67a1c39ab2831d1711a98f8f9421f7c1b5
-
SHA512
72cb20d5c019cdc2ab72e5ea2c2a41e4aab0d44941b91f158b916ac8f0ff805c52983db2c15d3c5ac0e4507962b35c64034ca2ba9457b60e0daed32958b600e4
-
SSDEEP
768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV
Behavioral task
behavioral1
Sample
0x000600000001ac45-52.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0x000600000001ac45-52.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
smokeloader
2022
http://194.49.94.210/fks/index.php
Extracted
redline
@ytlogsbot
194.169.175.235:42691
Extracted
redline
LiveTraffic
195.10.205.16:2245
Extracted
smokeloader
up3
Targets
-
-
Target
0x000600000001ac45-52.dat
-
Size
38KB
-
MD5
cb357a30e6e1350f4da4cbd44499fbae
-
SHA1
ab0538e676f32fa42d9d01d494c155da7568256e
-
SHA256
f7239524fdc6dc33d49c5087a436da67a1c39ab2831d1711a98f8f9421f7c1b5
-
SHA512
72cb20d5c019cdc2ab72e5ea2c2a41e4aab0d44941b91f158b916ac8f0ff805c52983db2c15d3c5ac0e4507962b35c64034ca2ba9457b60e0daed32958b600e4
-
SSDEEP
768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sV
-
Detect ZGRat V1
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1