Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5755009e6a34f037e90a17ccd059cc44.exe
Resource
win7-20231215-en
4 signatures
150 seconds
General
-
Target
5755009e6a34f037e90a17ccd059cc44.exe
-
Size
338KB
-
MD5
5755009e6a34f037e90a17ccd059cc44
-
SHA1
164bca1a97fd346352aeb645922fd9a3e8f7a1ab
-
SHA256
f1ae795f186c015b05fd1572f41fb43b0cd267bf135d98a3e12d2dc8c7b90e3e
-
SHA512
360e64220bc9316bdf087e1a1e5b1cb55e6e2713f78f029995c3ba72cee91b12d37bdcd8f5cc597bcecc5d24a0cd1238049cf23d67a1c520620bdab0d7d06cfe
-
SSDEEP
6144:p/MJTKpzkWBJ9vmS0fiZEK80OG51pUV8kBmJEs96WdA3rRVNwX/iu:k+JkEzOSpZEx0Jf6pBmJEs9uw6u
Malware Config
Extracted
Family
redline
Botnet
test
C2
193.56.146.78:51487
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral2/memory/4728-7-0x0000000004190000-0x00000000041B4000-memory.dmp family_redline behavioral2/memory/4728-10-0x0000000004380000-0x00000000043A2000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
resource yara_rule behavioral2/memory/4728-7-0x0000000004190000-0x00000000041B4000-memory.dmp family_sectoprat behavioral2/memory/4728-10-0x0000000004380000-0x00000000043A2000-memory.dmp family_sectoprat behavioral2/memory/4728-23-0x0000000006CB0000-0x0000000006CC0000-memory.dmp family_sectoprat