Analysis
-
max time kernel
222s -
max time network
426s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
01/05/2023, 21:07
General
-
Target
nes/Little Ninja Brothers.ps1
-
Size
256KB
-
MD5
e9886694c901d8bcec5a9125ae679acf
-
SHA1
406aff51e1856c398423283b11cc48bf817ba0f9
-
SHA256
d1ac260d9b0084469da292a42f06a49ec9042f80be85ad6d8909daa15828aaaa
-
SHA512
7d85a57b1569418b6dd368e8bdf1d8a35a69eff67c18fa9e61201bdf76d4fd21164244e1d39a477bca447ce5f9477afeea9408e0f60a8bf3413429735d9d07f9
-
SSDEEP
6144:UYbmNjM02eDAYIHtEcyNBRTnXgoPC6dt:zmp2isDWnXgoPf/
Score
10/10
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\nes\Little Ninja Brothers.ps1"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
220KB