Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5755009e6a34f037e90a17ccd059cc44.exe
Resource
win7-20231215-en
4 signatures
150 seconds
General
-
Target
5755009e6a34f037e90a17ccd059cc44.exe
-
Size
338KB
-
MD5
5755009e6a34f037e90a17ccd059cc44
-
SHA1
164bca1a97fd346352aeb645922fd9a3e8f7a1ab
-
SHA256
f1ae795f186c015b05fd1572f41fb43b0cd267bf135d98a3e12d2dc8c7b90e3e
-
SHA512
360e64220bc9316bdf087e1a1e5b1cb55e6e2713f78f029995c3ba72cee91b12d37bdcd8f5cc597bcecc5d24a0cd1238049cf23d67a1c520620bdab0d7d06cfe
-
SSDEEP
6144:p/MJTKpzkWBJ9vmS0fiZEK80OG51pUV8kBmJEs96WdA3rRVNwX/iu:k+JkEzOSpZEx0Jf6pBmJEs9uw6u
Malware Config
Extracted
Family
redline
Botnet
test
C2
193.56.146.78:51487
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
resource yara_rule behavioral1/memory/1980-4-0x00000000024D0000-0x00000000024F4000-memory.dmp family_redline behavioral1/memory/1980-6-0x0000000006700000-0x0000000006740000-memory.dmp family_redline behavioral1/memory/1980-8-0x00000000024F0000-0x0000000002512000-memory.dmp family_redline behavioral1/memory/1980-9-0x0000000006700000-0x0000000006740000-memory.dmp family_redline -
SectopRAT payload 4 IoCs
resource yara_rule behavioral1/memory/1980-4-0x00000000024D0000-0x00000000024F4000-memory.dmp family_sectoprat behavioral1/memory/1980-6-0x0000000006700000-0x0000000006740000-memory.dmp family_sectoprat behavioral1/memory/1980-8-0x00000000024F0000-0x0000000002512000-memory.dmp family_sectoprat behavioral1/memory/1980-9-0x0000000006700000-0x0000000006740000-memory.dmp family_sectoprat