General
-
Target
eb6ef474e713de8cd2f8922515d3cf247ba4ba1c33c7e7485193c568a6396d48
-
Size
1.7MB
-
Sample
241110-d6lvqsygkg
-
MD5
c1b2a0dd1794132f5bf85c8a1aa443a9
-
SHA1
35fae0c8128aaef90d9235b67d9e9aca51ce49c1
-
SHA256
eb6ef474e713de8cd2f8922515d3cf247ba4ba1c33c7e7485193c568a6396d48
-
SHA512
826c9c4dc020f6f43fdef3f54e58e0593e0541a04217ed642112cb43ea62136cc5c564b0315dc6b319fdc5d5573e7f9dc467f2ed940b7463bddd6f3d0cd1f3cd
-
SSDEEP
49152:0gs5uh6bgsmceUzOOtWGjDfJWSZiLifQh77LqC:hs5YPsmIzTtWGDf5ZiGY
Static task
static1
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
most
185.161.248.73:4164
-
auth_value
7da4dfa153f2919e617aa016f7c36008
Targets
-
-
Target
eb6ef474e713de8cd2f8922515d3cf247ba4ba1c33c7e7485193c568a6396d48
-
Size
1.7MB
-
MD5
c1b2a0dd1794132f5bf85c8a1aa443a9
-
SHA1
35fae0c8128aaef90d9235b67d9e9aca51ce49c1
-
SHA256
eb6ef474e713de8cd2f8922515d3cf247ba4ba1c33c7e7485193c568a6396d48
-
SHA512
826c9c4dc020f6f43fdef3f54e58e0593e0541a04217ed642112cb43ea62136cc5c564b0315dc6b319fdc5d5573e7f9dc467f2ed940b7463bddd6f3d0cd1f3cd
-
SSDEEP
49152:0gs5uh6bgsmceUzOOtWGjDfJWSZiLifQh77LqC:hs5YPsmIzTtWGDf5ZiGY
-
Amadey family
-
Detects Healer an antivirus disabler dropper
-
Healer family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Redline family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1