General
-
Target
20ae88fa8c744cb2bb82239dd0f8afbbf7eedcbd3985a897448b6162d9a1317c
-
Size
516KB
-
Sample
241110-cmgk8sxdqc
-
MD5
9374623db2f9a296cfd045042ee382de
-
SHA1
3007e721612844507fe1d05d1ce42edc6433e029
-
SHA256
20ae88fa8c744cb2bb82239dd0f8afbbf7eedcbd3985a897448b6162d9a1317c
-
SHA512
e08b9175b6e982b87551a919d10fcf694c0bd3ca2a5866cb7e05b2454a6b4946cb6772f982742d701ef93bc2c4074843a90f8df59a774e451d883e23ffb5e179
-
SSDEEP
12288:mMrny90IrWD+Fg2FHxZI2s0KtuvxUkgBYCKNLzr:By9pzw2J6rzgLP
Static task
static1
Malware Config
Extracted
amadey
3.86
88c8bb
http://77.91.68.61
-
install_dir
925e7e99c5
-
install_file
pdates.exe
-
strings_key
ada76b8b0e1f6892ee93c20ab8946117
-
url_paths
/rock/index.php
Extracted
redline
gotad
77.91.124.84:19071
-
auth_value
3fb7c1f3fcf68bc377eae3f6f493a684
Targets
-
-
Target
20ae88fa8c744cb2bb82239dd0f8afbbf7eedcbd3985a897448b6162d9a1317c
-
Size
516KB
-
MD5
9374623db2f9a296cfd045042ee382de
-
SHA1
3007e721612844507fe1d05d1ce42edc6433e029
-
SHA256
20ae88fa8c744cb2bb82239dd0f8afbbf7eedcbd3985a897448b6162d9a1317c
-
SHA512
e08b9175b6e982b87551a919d10fcf694c0bd3ca2a5866cb7e05b2454a6b4946cb6772f982742d701ef93bc2c4074843a90f8df59a774e451d883e23ffb5e179
-
SSDEEP
12288:mMrny90IrWD+Fg2FHxZI2s0KtuvxUkgBYCKNLzr:By9pzw2J6rzgLP
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1