Analysis
-
max time kernel
4294193s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
17-03-2022 06:31
Behavioral task
behavioral1
Sample
buil 2.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
buil 2.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
buil 2.exe
-
Size
107KB
-
MD5
9e3d2a331c57fcaf3824307d033f1930
-
SHA1
3f455f14db41f8227fccdde0a62ac4a594051e9e
-
SHA256
cf86cb002e196c5c2412fdbc4bda9a72179378f52e0d56300965a4231d2734de
-
SHA512
49e08267689b8244c5cc99b1a426bfd029c15580d7f241cbfa73fc3059420afcedfa8cc39d23b01404dd0f0f04fb28dd68d76328d8611cab7b9a7a8686220c90
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
firefox
C2
45.77.42.218:1753
Attributes
-
auth_value
1f07c368f7f69023a22d1351d2f1bd41
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-54-0x00000000011E0000-0x0000000001200000-memory.dmp family_redline