General
-
Target
400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9
-
Size
517KB
-
Sample
241109-ejryxaxclj
-
MD5
9d3e048de290cf4d15c26566c077a18f
-
SHA1
d518f31a9503e549cc4b547efd0456f9bf1ae790
-
SHA256
400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9
-
SHA512
8d464e69abf8d79b60bdcdc431f24d9a6430c5a4c7ab293c415dd6e490ae9767a65f4e8e9691d80220c9c0f41c77dbbe6e977e30d7a0116f959f791f85901278
-
SSDEEP
12288:rMrEby90KQuChccHtoC/rFS3SG/SE/jkmWvGqCP:dyopOQtol+ELbOdCP
Static task
static1
Malware Config
Extracted
amadey
3.86
88c8bb
http://77.91.68.61
-
install_dir
925e7e99c5
-
install_file
pdates.exe
-
strings_key
ada76b8b0e1f6892ee93c20ab8946117
-
url_paths
/rock/index.php
Extracted
redline
gotad
77.91.124.84:19071
-
auth_value
3fb7c1f3fcf68bc377eae3f6f493a684
Targets
-
-
Target
400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9
-
Size
517KB
-
MD5
9d3e048de290cf4d15c26566c077a18f
-
SHA1
d518f31a9503e549cc4b547efd0456f9bf1ae790
-
SHA256
400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9
-
SHA512
8d464e69abf8d79b60bdcdc431f24d9a6430c5a4c7ab293c415dd6e490ae9767a65f4e8e9691d80220c9c0f41c77dbbe6e977e30d7a0116f959f791f85901278
-
SSDEEP
12288:rMrEby90KQuChccHtoC/rFS3SG/SE/jkmWvGqCP:dyopOQtol+ELbOdCP
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1