General
-
Target
file
-
Size
298KB
-
Sample
231207-vmfcaaea48
-
MD5
bfb4242a84f3b9fa4a50a2d87edbf339
-
SHA1
acf1c7323389e929c91f2fd405f2724dfdc0746f
-
SHA256
5d9a1b17900f2debcf5f4ffd3eeeec396d373ccc2c26f6d6e4f9ab429ea68968
-
SHA512
07f029f3d61d869d523e6feafb247c814226cbd6bbdd3d226a936b1f467386763529fdde18a97bedcc23276beac95af7ac54c242fa2ae19b296b2bbe402f772f
-
SSDEEP
3072:5eEZcvGUu2aXWRujSwT8vRrtQNPB6b/Vt4bY52ZapPwOeTsWL:E++pu5uu94NtQZBE9t4LMpoT
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
redline
1207-55000
38.47.221.193:34368
Extracted
smokeloader
pub1
Targets
-
-
Target
file
-
Size
298KB
-
MD5
bfb4242a84f3b9fa4a50a2d87edbf339
-
SHA1
acf1c7323389e929c91f2fd405f2724dfdc0746f
-
SHA256
5d9a1b17900f2debcf5f4ffd3eeeec396d373ccc2c26f6d6e4f9ab429ea68968
-
SHA512
07f029f3d61d869d523e6feafb247c814226cbd6bbdd3d226a936b1f467386763529fdde18a97bedcc23276beac95af7ac54c242fa2ae19b296b2bbe402f772f
-
SSDEEP
3072:5eEZcvGUu2aXWRujSwT8vRrtQNPB6b/Vt4bY52ZapPwOeTsWL:E++pu5uu94NtQZBE9t4LMpoT
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Modifies Windows Firewall
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies boot configuration data using bcdedit
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1