Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
24-04-2023 15:39
General
-
Target
Redline Stealer v24.2 cracked [XT_CH]/Kurome.Loader/._cache_KuromeLoader.exe
-
Size
2.2MB
-
MD5
c1bf694a0aab442c2b3d40ec4f56ace5
-
SHA1
2ea6ef48ac190a26a738e22ad454b91fc58d3218
-
SHA256
00ae4b11e9757721ff825a6d84e0afefb810ce0e062c836503ca14141ca31a39
-
SHA512
d8386440e89c1ae538f53bb5a9ee4d8030b6067eb1c6d18fadd118e88d506e11343c0f3cd58bc2636739ade87aef821e2513f0aa8a760bd9787a07a49a48c610
-
SSDEEP
49152:rnsHyjtk2MYC5GDeCouKZ6iMqRl2PSwzehy6cpXShTouKZ6iMqRl2PSwzehy6cpu:rnsmtk2a9UzehkUzehz
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Panda Stealer payload 1 IoCs
-
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Async RAT payload 1 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redline Stealer v24.2 cracked [XT_CH]\Kurome.Loader\._cache_KuromeLoader.exe"C:\Users\Admin\AppData\Local\Temp\Redline Stealer v24.2 cracked [XT_CH]\Kurome.Loader\._cache_KuromeLoader.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6202⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3228-117-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/3228-118-0x0000000000400000-0x0000000000635000-memory.dmpFilesize
2.2MB