Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-03-2024 04:52
General
-
Target
cd26d1159f20d37cca1aa22af82cf6a3.exe
-
Size
309KB
-
MD5
cd26d1159f20d37cca1aa22af82cf6a3
-
SHA1
f24612e9ae118b4a885c3983022d33da0009a70a
-
SHA256
5d7e056cab62d45da796272f782b92fdba8c38827e678fa1273c0ccb71aa6d83
-
SHA512
171da49fd4d34e07bd50c46f27b08d1fb96f4d65706fee68ac76c7ab068c89cefa0a97034b4d8a2bc326174ead329a009ad94993d782e2bf5e3e291f7a32d515
-
SSDEEP
6144:KhLDRPVxtbyDT9B70uWaHfwkLhpgsgFVg8FY6xA:Khvdt+70u/H5S4
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
zaliv
C2
185.244.216.219:33828
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd26d1159f20d37cca1aa22af82cf6a3.exe"C:\Users\Admin\AppData\Local\Temp\cd26d1159f20d37cca1aa22af82cf6a3.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
192KB
-
Filesize
25.6MB
-
Filesize
152KB
-
Filesize
256KB
-
Filesize
144KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB