General
-
Target
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da
-
Size
1.9MB
-
Sample
240329-wdej3aef37
-
MD5
864674e8be395eb28bb181184add5c01
-
SHA1
79bb9c0ae54bf8572328af06b6576327bd0a386c
-
SHA256
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da
-
SHA512
7f85146e5cca26f5a388aeea88cf9d86819aed6e240c3b94569967a2074654327e531be66f1335f9fa0790f13844c65315a3020d0e9c6bdce40c3605164abc25
-
SSDEEP
49152:EJ8NNvupgJi+RYYhQx/QAfi4oxa03C+v7sOh9yPQtE:Xvu+RIx/QAfiTY03C+z/yP
Static task
static1
Behavioral task
behavioral1
Sample
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da.exe
Resource
win11-20240319-en
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
Protocol: smtp- Host:
smtp.netzero.com - Port:
587 - Username:
[email protected] - Password:
1366613
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
MAJORIA1
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
toys4us
Extracted
Protocol: smtp- Host:
smtp.homtail.co.uk - Port:
587 - Username:
[email protected] - Password:
paige123
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
pRECIOUS
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
081265
Extracted
Protocol: smtp- Host:
smtp.frontiernet.net - Port:
587 - Username:
[email protected] - Password:
00704089
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
douglas954
Extracted
Protocol: smtp- Host:
mx.mannbdinfo.org - Port:
587 - Username:
[email protected] - Password:
kHnFvq8E
Extracted
Protocol: smtp- Host:
mail.zilladog.com - Port:
587 - Username:
[email protected] - Password:
terakoodom
Extracted
Protocol: smtp- Host:
smtp.hotamil.com - Port:
587 - Username:
[email protected] - Password:
Mirian03
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
cats2
Extracted
Protocol: smtp- Host:
smtp.netzero.com - Port:
587 - Username:
[email protected] - Password:
mygirls2
Extracted
Protocol: smtp- Host:
mx.breakthur.com - Port:
587 - Username:
[email protected] - Password:
ej4yv4o6AE
Extracted
Protocol: smtp- Host:
mx.breakthur.com - Port:
587 - Username:
[email protected] - Password:
3d8Cubaj2E
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
102465
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
102205
Extracted
Protocol: smtp- Host:
smtp.netzero.com - Port:
587 - Username:
[email protected] - Password:
lilil699466
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
ga400ga
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
92497
Extracted
Protocol: smtp- Host:
smtp.netzero.com - Port:
587 - Username:
[email protected] - Password:
152245
Extracted
Protocol: smtp- Host:
smtp.netzero.com - Port:
587 - Username:
[email protected] - Password:
AsShole666
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
GOODDAD411
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
beer4u2
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
airforce
Extracted
Protocol: smtp- Host:
smtp.frontiernet.net - Port:
587 - Username:
[email protected] - Password:
Asp007@
Extracted
Protocol: smtp- Host:
smtp.jcom.home.ne.jp - Port:
587 - Username:
[email protected] - Password:
chesheir06076
Extracted
Protocol: smtp- Host:
mx.hotil.it - Port:
587 - Username:
[email protected] - Password:
Aaaaaa1!w
Extracted
Protocol: smtp- Host:
smtp.jcom.home.ne.jp - Port:
587 - Username:
[email protected] - Password:
bun1933
Extracted
Protocol: smtp- Host:
kimkulish.com - Port:
587 - Username:
[email protected]
Extracted
Protocol: smtp- Host:
smtp.frontier.com - Port:
587 - Username:
[email protected] - Password:
mooses1217
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
Shithead12
Extracted
Protocol: smtp- Host:
smtp.frontiernet.net - Port:
587 - Username:
[email protected] - Password:
nikki9966
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
SS209XD9
Extracted
Protocol: smtp- Host:
smtp.frontier.com - Port:
587 - Username:
[email protected] - Password:
w7M6xefr
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
NEWLIFENOW
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
greta
Extracted
Protocol: smtp- Host:
mail.ohara.org.uk - Port:
587 - Username:
[email protected] - Password:
L31c35t3r$$*1@
Extracted
Protocol: smtp- Host:
smtp.netzero.net - Port:
587 - Username:
[email protected] - Password:
CETHIE
Extracted
Protocol: smtp- Host:
mail01.ebiz.hosting.mt.im - Port:
587 - Username:
[email protected] - Password:
Scallywag
Extracted
Protocol: smtp- Host:
smtp.frontiernet.net - Port:
587 - Username:
[email protected] - Password:
buttermiseancerretani93
Extracted
Protocol: smtp- Host:
smtp.jcom.home.ne.jp - Port:
587 - Username:
[email protected] - Password:
eiko0326
Extracted
Protocol: smtp- Host:
smtp.frontier.com - Port:
587 - Username:
[email protected] - Password:
Whiskers1
Extracted
Protocol: smtp- Host:
smtp.citlink.net - Port:
587 - Username:
[email protected] - Password:
shargill
Extracted
Protocol: smtp- Host:
mx.progiftstore.org - Port:
587 - Username:
[email protected] - Password:
3EHd1ixi1Y3eHd1ixi1Y!
Extracted
Protocol: smtp- Host:
smtp.frontier.com - Port:
587 - Username:
[email protected] - Password:
samples
Extracted
Protocol: smtp- Host:
mx.abcnetworkingu.pl - Port:
587 - Username:
[email protected] - Password:
rootGa1spz35r1b
Extracted
Protocol: smtp- Host:
smtp.nifty.ne.jp - Port:
587 - Username:
[email protected] - Password:
nana77
Extracted
Protocol: smtp- Host:
smtp-box-01.iol.pt - Port:
587 - Username:
[email protected] - Password:
zztop
Extracted
Protocol: smtp- Host:
smtp-box-01.iol.pt - Port:
587 - Username:
[email protected] - Password:
ed11cfe3
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
redline
Jok123
185.215.113.67:26260
Extracted
amadey
4.17
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
redline
LiveTraffic
4.185.137.132:1632
Extracted
lumma
https://enthusiasimtitleow.shop/api
Targets
-
-
Target
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da
-
Size
1.9MB
-
MD5
864674e8be395eb28bb181184add5c01
-
SHA1
79bb9c0ae54bf8572328af06b6576327bd0a386c
-
SHA256
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da
-
SHA512
7f85146e5cca26f5a388aeea88cf9d86819aed6e240c3b94569967a2074654327e531be66f1335f9fa0790f13844c65315a3020d0e9c6bdce40c3605164abc25
-
SSDEEP
49152:EJ8NNvupgJi+RYYhQx/QAfi4oxa03C+v7sOh9yPQtE:Xvu+RIx/QAfiTY03C+z/yP
-
Detect ZGRat V1
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Contacts a large (672) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
2Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1