General
-
Target
49e8fba664cd8d538e8b5911dc575e7b873ea97de7ad70e1498539ff671a8bd4
-
Size
1.8MB
-
Sample
240602-glnelsde57
-
MD5
028dd36801f3b1f0b82a5c75f181798f
-
SHA1
372f942dfe325d3cd22ef8f172d8d7cb90dc14f0
-
SHA256
49e8fba664cd8d538e8b5911dc575e7b873ea97de7ad70e1498539ff671a8bd4
-
SHA512
b5cdc00601d5b660ccbd755a40960f260dbe2a52ac0b240b8933fb20d023cff7b55536f241d1aec05afdefde5e662be11dd01c9d9a0b62cad97f487d21f5bb98
-
SSDEEP
49152:y38J7qrsixjUqzmAou4QCjBRGyVrnjGts2HqqGmkVW:W8FqrFx4q6AouErGyVrnjGWilQw
Static task
static1
Behavioral task
behavioral1
Sample
49e8fba664cd8d538e8b5911dc575e7b873ea97de7ad70e1498539ff671a8bd4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
49e8fba664cd8d538e8b5911dc575e7b873ea97de7ad70e1498539ff671a8bd4.exe
Resource
win11-20240419-en
Malware Config
Extracted
amadey
4.21
0e6740
http://147.45.47.155
-
install_dir
9217037dc9
-
install_file
explortu.exe
-
strings_key
8e894a8a4a3d0da8924003a561cfb244
-
url_paths
/ku4Nor9/index.php
Extracted
risepro
147.45.47.126:58709
Extracted
amadey
4.21
49e482
http://147.45.47.70
-
install_dir
1b29d73536
-
install_file
axplont.exe
-
strings_key
4d31dd1a190d9879c21fac6d87dc0043
-
url_paths
/tr8nomy/index.php
Extracted
redline
newbild
185.215.113.67:40960
Extracted
smokeloader
pub1
Targets
-
-
Target
49e8fba664cd8d538e8b5911dc575e7b873ea97de7ad70e1498539ff671a8bd4
-
Size
1.8MB
-
MD5
028dd36801f3b1f0b82a5c75f181798f
-
SHA1
372f942dfe325d3cd22ef8f172d8d7cb90dc14f0
-
SHA256
49e8fba664cd8d538e8b5911dc575e7b873ea97de7ad70e1498539ff671a8bd4
-
SHA512
b5cdc00601d5b660ccbd755a40960f260dbe2a52ac0b240b8933fb20d023cff7b55536f241d1aec05afdefde5e662be11dd01c9d9a0b62cad97f487d21f5bb98
-
SSDEEP
49152:y38J7qrsixjUqzmAou4QCjBRGyVrnjGts2HqqGmkVW:W8FqrFx4q6AouErGyVrnjGWilQw
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1