Analysis
-
max time kernel
212s -
max time network
243s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 13:03
Behavioral task
behavioral1
Sample
0x0007000000023252-41.exe
Resource
win7-20230831-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0x0007000000023252-41.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0x0007000000023252-41.exe
-
Size
221KB
-
MD5
7e8746bcea9d42b96e183a27588b6a19
-
SHA1
56483ef677b82cf30eff13ac3d70b21b8ce8df00
-
SHA256
408925973abf773d0c68e3ec9af691c027ce70cfc9dfe1b35d4cccc7c6d07a2e
-
SHA512
af9251710dc8aa6df553c102af8d51157f3c732f2e7739a51f6beb1668c8da20b00b68465d1d9fa27ffe1713ed75e66063f8fbf29c5ada6b6e073f9d9ba5d382
-
SSDEEP
3072:TtJXRMeZYncNgckxQdxCr1d2t/q5yoQVZL53pRzzXZQAZ:TJMeucNgckedxCDo/doQVZdZRzzXZQ
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
kukish
C2
77.91.124.55:19071
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2816-0-0x0000000000AC0000-0x0000000000AFE000-memory.dmp family_redline