Overview
overview
10Static
static
3Aquantia.rar
windows7-x64
3Aquantia.rar
windows10-2004-x64
3Aquantia (...d).rar
windows7-x64
3Aquantia (...d).rar
windows10-2004-x64
7Aquantia_S...21.exe
windows7-x64
3Aquantia_S...21.exe
windows10-2004-x64
10jre/Welcome.html
windows7-x64
1jre/Welcome.html
windows10-2004-x64
1jre/bin/JA...32.dll
windows7-x64
1jre/bin/JA...32.dll
windows10-2004-x64
1jre/bin/JA...ge.dll
windows7-x64
1jre/bin/JA...ge.dll
windows10-2004-x64
1jre/bin/Ja...32.dll
windows7-x64
1jre/bin/Ja...32.dll
windows10-2004-x64
1jre/bin/Ja...ge.dll
windows7-x64
1jre/bin/Ja...ge.dll
windows10-2004-x64
1jre/bin/Wi...32.dll
windows7-x64
3jre/bin/Wi...32.dll
windows10-2004-x64
3jre/bin/Wi...ge.dll
windows7-x64
3jre/bin/Wi...ge.dll
windows10-2004-x64
3jre/bin/awt.dll
windows7-x64
1jre/bin/awt.dll
windows10-2004-x64
1jre/bin/bci.dll
windows7-x64
3jre/bin/bci.dll
windows10-2004-x64
3jre/bin/cl...vm.dll
windows7-x64
3jre/bin/cl...vm.dll
windows10-2004-x64
3jre/bin/dcpr.dll
windows7-x64
1jre/bin/dcpr.dll
windows10-2004-x64
1jre/bin/de...se.dll
windows7-x64
3jre/bin/de...se.dll
windows10-2004-x64
3jre/bin/deploy.dll
windows7-x64
3jre/bin/deploy.dll
windows10-2004-x64
3General
-
Target
Aquantia.rar
-
Size
65.8MB
-
Sample
240515-14bnbaeh58
-
MD5
7f02c52198f99582ab683832f20dba6e
-
SHA1
9ea78dd557a35925cfd956d8537bac15d42f8e5d
-
SHA256
3645442ebc0c3e7341d97e548d5aea7c0c645032f4291626a012b8d20e619b2b
-
SHA512
6c7bf69fa7df2183690c982e77edcf3bca039e7c94fc246c56d11f089f35ded3bdb59b06f49181095fd0590aa3553ffbe25818c00cfd38fddddbb947ea187425
-
SSDEEP
1572864:LkD1/GRByaaXhodLj9S2uQxzBV0LY2wLwqAodlznqycA:A5eRByaaXhGLpS2uQAZOlGyH
Static task
static1
Behavioral task
behavioral1
Sample
Aquantia.rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Aquantia.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Aquantia (Updated).rar
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Aquantia (Updated).rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Aquantia_Setup 2.21.exe
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
Aquantia_Setup 2.21.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
jre/Welcome.html
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
jre/Welcome.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
jre/bin/JAWTAccessBridge-32.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
jre/bin/JAWTAccessBridge-32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
jre/bin/JAWTAccessBridge.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
jre/bin/JAWTAccessBridge.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
jre/bin/JavaAccessBridge-32.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
jre/bin/JavaAccessBridge-32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
jre/bin/JavaAccessBridge.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
jre/bin/JavaAccessBridge.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
jre/bin/WindowsAccessBridge-32.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
jre/bin/WindowsAccessBridge-32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
jre/bin/WindowsAccessBridge.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
jre/bin/WindowsAccessBridge.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
jre/bin/awt.dll
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
jre/bin/awt.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
jre/bin/bci.dll
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
jre/bin/bci.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
jre/bin/client/jvm.dll
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
jre/bin/client/jvm.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
jre/bin/dcpr.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
jre/bin/dcpr.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
jre/bin/decora_sse.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
jre/bin/decora_sse.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
jre/bin/deploy.dll
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
jre/bin/deploy.dll
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
Aquantia.rar
-
Size
65.8MB
-
MD5
7f02c52198f99582ab683832f20dba6e
-
SHA1
9ea78dd557a35925cfd956d8537bac15d42f8e5d
-
SHA256
3645442ebc0c3e7341d97e548d5aea7c0c645032f4291626a012b8d20e619b2b
-
SHA512
6c7bf69fa7df2183690c982e77edcf3bca039e7c94fc246c56d11f089f35ded3bdb59b06f49181095fd0590aa3553ffbe25818c00cfd38fddddbb947ea187425
-
SSDEEP
1572864:LkD1/GRByaaXhodLj9S2uQxzBV0LY2wLwqAodlznqycA:A5eRByaaXhGLpS2uQAZOlGyH
Score3/10 -
-
-
Target
Aquantia (Updated).rar
-
Size
65.8MB
-
MD5
ab0e616a2221f9062f81698643231f95
-
SHA1
96802b3f02c4b0525f98aca6aa383e1570f06edc
-
SHA256
681e6cb16591f46cf02de28cdc880a78fc99584e82c479d1fcd16c2a326c33fb
-
SHA512
c49b35df253cb6d089d04677d3f0896660021c947776e47cb73386effa481d855a76226280c63a662ae93e442ed4a9f4d6a6ff872ac5ae626bc8cbc1756883a4
-
SSDEEP
1572864:7kD1/GRByaaXhodLj9S2uQxzBV0LY2wLwqAodlznqycR:w5eRByaaXhGLpS2uQAZOlGyY
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
Aquantia_Setup 2.21.exe
-
Size
444KB
-
MD5
829d044dd90914a5a0a1543488d58818
-
SHA1
2531edbe60762e02e3d729b9c5651d4aa53d5fc7
-
SHA256
4e76f5d56bf61ae44bafba32196b2d5d93c1f4fcef553f1c54622ff24337f6c9
-
SHA512
040bd4620f33c5c2de9afb968957f87e2fafbde7740857b765a61b5208eda01c7ab148e34d47df0d42a4e8b684010dfd2a996dbcdca983b5af602322fa0f40e3
-
SSDEEP
6144:dCaivxI00XCKEnt6Lqtq13Y57pqJHCwMFYe/hxYbjdyIVCUdlgh2B+TNPZ0NEl:divxdkClWIdpqJHC1YCHBInM3NRBl
Score10/10-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-
-
-
Target
jre/Welcome.html
-
Size
983B
-
MD5
3cb773cb396842a7a43ad4868a23abe5
-
SHA1
ace737f039535c817d867281190ca12f8b4d4b75
-
SHA256
f450aee7e8fe14512d5a4b445aa5973e202f9ed1e122a8843e4dc2d4421015f0
-
SHA512
6058103b7446b61613071c639581f51718c12a9e7b6abd3cf3047a3093c2e54b2d9674faf9443570a3bb141f839e03067301ff35422eb9097bd08020e0dd08a4
Score1/10 -
-
-
Target
jre/bin/JAWTAccessBridge-32.dll
-
Size
14KB
-
MD5
d63933f4e279a140cc2a941ccff38348
-
SHA1
75169be2e9bcfe20674d72d43ca6e2bc4a5a9382
-
SHA256
532d049e0d7a265754902c23b0f150d665a78a3d6fe09ad51c9be8c29d574a3d
-
SHA512
d7a5023a5eb9b0c3b2ad6f55696a166f07fa60f9d1a12d186b23aaaacc92ef948cb5dffa013afc90c4bbe3de077d591185902384f677d0bae2ff7cfd5db5e06c
-
SSDEEP
192:7pQMhM63XLPVT6MsMPapRuBUEp7nYe+PjPriT0fwtK:7muL7PV4aapRuBTp7nYPLr7J
Score1/10 -
-
-
Target
jre/bin/JAWTAccessBridge.dll
-
Size
14KB
-
MD5
b4eb9b43c293074406adca93681bf663
-
SHA1
16580fb7139d06a740f30d34770598391b70ac96
-
SHA256
8cd69af7171f24d57cf1e6d0d7acd2b35b4ea5fdf55105771141876a67917c52
-
SHA512
a4e999e162b5083b6c6c3eafee4d84d1ec1c61dca6425f849f352ffdccc2e44dfee0625c210a8026f9ff141409eebf9ef15a779b26f59b88e74b6a2ce2e82ef9
-
SSDEEP
192:0Usw4DPU3XLPVT6GsKOhWIutUinYe+PjPriT0fwyI8:ew7PVIKyWIutDnYPLr728
Score1/10 -
-
-
Target
jre/bin/JavaAccessBridge-32.dll
-
Size
125KB
-
MD5
2f808ed0642bd5cf8d4111e0af098bbb
-
SHA1
006163a07052f3d227c2e541691691b4567f5550
-
SHA256
61dfb6126eba8d5429f156eaab24ff30312580b0abe4009670f1dd0bc64f87bb
-
SHA512
27dbda3a922747a031ff7434de5a596725ff5ae2bc6dd83d6d5565eb2ba180b0516896323294459997b545c60c9e06da6c2d8dd462a348a6759a404db0f023a7
-
SSDEEP
3072:uN77TJSG78+5Orcj5K/e2Hrgc6kZAn1yEkBKMKy1Zf22QYHJiuzTl8ShzzM+64mn:uNXd178+5fJZnQLo
Score1/10 -
-
-
Target
jre/bin/JavaAccessBridge.dll
-
Size
124KB
-
MD5
c3ded5f41e28faf89338fb46382e4c3e
-
SHA1
6f77920776d39550355b146d672c199a3941f908
-
SHA256
4691603dfabe6d7b7beac887dadc0e96243c2ff4f9a88ce3793e93356c53aa08
-
SHA512
23621f2856899f40cfa9858dc277372bfe39f0205377543eb23e94422d479a53fdf664f4a9a4515c2285811f01d91ab64a834a03a4d3ab0cb7d78f8af11135ff
-
SSDEEP
3072:SdQ4jWJt4XChlFavveKSQ4gHK/e2Hrgc6kZAn1y1koKMKy1Zf22QYHJiuzTl8ShM:Sy4SJ1TFavvehc7ZnwEr
Score1/10 -
-
-
Target
jre/bin/WindowsAccessBridge-32.dll
-
Size
95KB
-
MD5
f78d2bf2c551be9df6a2f3210a2964c1
-
SHA1
b6a4160eca4c0d0552234ff69bcfdf45f0a2a352
-
SHA256
9d18e5421a8606985fa54d7cea921d1b8930358a2e4cdf5fdf2a8b3e4d857288
-
SHA512
aac8622683be57518f8b03198a03bf1f760e082692c1fb6252e96cdba19d3ceb0a6786ccbd7b98830e865297308fa99dbbea464e41041abdda18aeb862ba993f
-
SSDEEP
1536:/fHGbDtpt+WfGegcX30EJ4YHiYmRkgAPe+GP8uWg1kQOPt:/w2WfGe/30EWbY4Z+GpWuHOPt
Score3/10 -
-
-
Target
jre/bin/WindowsAccessBridge.dll
-
Size
93KB
-
MD5
e5a6231fe1e6fec5f547dfd845d209bc
-
SHA1
3f21f90ecc377b6099637d5b59593d2415450d45
-
SHA256
51355ea8a7dc238483c8069361776103779ce9fe3cd0267770e321e6e4368366
-
SHA512
d5d20df0089f3217b627d39abd57c61e026d0dc537022fb698f85fa6893c7fa348c40295deec78506f0ef608827d39e2f6f3538818ba25e2a0ee1145fcc95940
-
SSDEEP
1536:EHSB4i2hJwZaDEoDVzkhbyJCAqn9nV+1vkJnHBoY8BK5Hj:EJJwZWEoDVYby81yiBovkHj
Score3/10 -
-
-
Target
jre/bin/awt.dll
-
Size
1.1MB
-
MD5
159ccf1200c422ced5407fed35f7e37d
-
SHA1
177a216b71c9902e254c0a9908fcb46e8d5801a9
-
SHA256
30eb581c99c8bcbc54012aa5e6084b6ef4fcee5d9968e9cc51f5734449e1ff49
-
SHA512
ab3f4e3851313391b5b8055e4d526963c38c4403fa74fb70750cc6a2d5108e63a0e600978fa14a7201c48e1afd718a1c6823d091c90d77b17562b7a4c8c40365
-
SSDEEP
24576:68M4H6ioDs5FELnSbY6Ck2IlAnVCXQlFg3:9eaGnkXQlFQ
Score1/10 -
-
-
Target
jre/bin/bci.dll
-
Size
15KB
-
MD5
a46289384f76c2a41ba7251459849288
-
SHA1
4d8ef96edbe07c8722fa24e4a5b96ebfa18be2c4
-
SHA256
728d64bc1fbf48d4968b1b93893f1b5db88b052ab82202c6840bf7886a64017d
-
SHA512
34d62beb1fa7d8630f5562c1e48839ce9429faea980561e58076df5f19755761454eeb882790ec1035c64c654fc1a8cd5eb46eca12e2bc81449acbb73296c9e8
-
SSDEEP
384:1Td3hw/L3kKLnYgIOGOOssnPV5Lnf6onYPLr7EbH:1zw/bkKLt7KnddnfPC7S
Score3/10 -
-
-
Target
jre/bin/client/jvm.dll
-
Size
3.7MB
-
MD5
39c302fe0781e5af6d007e55f509606a
-
SHA1
23690a52e8c6578de6a7980bb78aae69d0f31780
-
SHA256
b1fbdbb1e4c692b34d3b9f28f8188fc6105b05d311c266d59aa5e5ec531966bc
-
SHA512
67f91a75e16c02ca245233b820df985bd8290a2a50480dff4b2fd2695e3cf0b4534eb1bf0d357d0b14f15ce8bd13c82d2748b5edd9cc38dc9e713f5dc383ed77
-
SSDEEP
98304:GyXul1SNceWfkD000V3wnIACM7g6cv/GZ:Q1SgfEP0ZwnIA97dcv/GZ
Score3/10 -
-
-
Target
jre/bin/dcpr.dll
-
Size
139KB
-
MD5
4bdc32ef5da731393acc1b8c052f1989
-
SHA1
a677c04ecd13f074de68cc41f13948d3b86b6c19
-
SHA256
a3b35cc8c2e6d22b5832af74aaf4d1bb35069edd73073dffec2595230ca81772
-
SHA512
e71ea78d45e6c6bd08b2c5cd31f003f911fd4c82316363d26945d17977c2939f65e3b9748447006f95c3c6653ce30d2cda67322d246d43c9eb892a8e83deb31a
-
SSDEEP
3072:aoGzTjLkRPQ9U9NuLqcNicj5ojGylYCE2Iu2jGLF5A9bE8LUekfCz:LGz/oRPGLJN1IGgYCE2L1F5A9bEGUeR
Score1/10 -
-
-
Target
jre/bin/decora_sse.dll
-
Size
62KB
-
MD5
b04abe76c4147de1d726962f86473cf2
-
SHA1
3104bada746678b0a88e5e4a77904d78a71d1ab8
-
SHA256
07ff22e96dcfd89226e5b85cc07c34318dd32cda23b7ea0474e09338654bfeb3
-
SHA512
2e4e2feb63b6d7388770d8132a880422abf6a01941bff12cad74db4a641bda2dcc8bf58f6dae90e41cc250b79e7956ddf126943e0f6200272f3376a9a19505f1
-
SSDEEP
1536:Skh2CQuUlng7qkKi5iO8pm8cN9qOU33oit:Skkhu0nTli5jN8cNAOUHnt
Score3/10 -
-
-
Target
jre/bin/deploy.dll
-
Size
442KB
-
MD5
5edaeffc60b5f1147068e4a296f6d7fb
-
SHA1
7d36698c62386449a5fa2607886f4adf7fb3deef
-
SHA256
87847204933551f69f1cba7a73b63a252d12ef106c22ed9c561ef188dffcbae8
-
SHA512
a691ef121d3ac17569e27bb6de4688d3506895b1a1a8740e1f16e80eefce70ba18b9c1efd6fd6794fafc59ba2caf137b4007fcdc65ddb8bcbfcf42c97b13535b
-
SSDEEP
6144:3J/sbugq7rm5zX2JDYfiA9+wvpsEWcIGnFm8iTFOBITfnvxIW1x8:3JUbzq+5zX25qvdfnFm88nvq+x8
Score3/10 -