Overview

overview

10

Static

static

1

GodsFxckTools2.5.exe

windows7-x64

10

GodsFxckTools2.5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2025, 21:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GodsFxckTools2.5.exe

  • Size

    14.0MB

  • MD5

    6190c77e3fe2aead6144fede72fe9d39

  • SHA1

    0d24a76b22f39b74f8b14eb2064139067ad2b47d

  • SHA256

    6a8bcf6323187b363a010c14c33f6577a03d8dc8f4f7bc21acea0b2bce80a983

  • SHA512

    54bb0d5529375e44fd28cfd7c285396da4bccde6eaf658cb7cd9cc37c366d646aae9e8acc65107e8749b2d1c643754a5ce37f38ff1ba424880abc4e52e37bab4

  • SSDEEP

    6144:riRQ9JQlU61nUt/ZoAsvRVZlOvraB6JBrWrZQMQsdx:riRQ92scXJlOvVBE4sdx

Score
10/10
redlinediscoveryinfostealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\GodsFxckTools2.5.exe
    "C:\Users\Admin\AppData\Local\Temp\GodsFxckTools2.5.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:5096

Network

  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.153.16.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.153.16.2.in-addr.arpa
    IN PTR
    Response
    11.153.16.2.in-addr.arpa
    IN PTR
    a2-16-153-11deploystaticakamaitechnologiescom
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 46.151.24.249:80
    GodsFxckTools2.5.exe
    260 B
     5
  • 46.151.24.249:80
    GodsFxckTools2.5.exe
    260 B
     5
  • 46.151.24.249:80
    GodsFxckTools2.5.exe
    260 B
     5
  • 46.151.24.249:80
    GodsFxckTools2.5.exe
    260 B
     5
  • 46.151.24.249:80
    GodsFxckTools2.5.exe
    260 B
     5
  • 46.151.24.249:80
    GodsFxckTools2.5.exe
    260 B
     5
  • 46.151.24.249:80
    GodsFxckTools2.5.exe
    260 B
     5
  • 46.151.24.249:80
    GodsFxckTools2.5.exe
    104 B
     2
  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    11.153.16.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    11.153.16.2.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5096-0-0x00000000003D0000-0x00000000003FE000-memory.dmp

    Filesize

    184KB

    Download

  • memory/5096-4-0x000000007465E000-0x000000007465F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5096-5-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/5096-6-0x0000000005380000-0x0000000005998000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/5096-7-0x0000000004D60000-0x0000000004D72000-memory.dmp

    Filesize

    72KB

    Download

  • memory/5096-8-0x0000000004E90000-0x0000000004F9A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/5096-9-0x0000000004DC0000-0x0000000004DFC000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5096-10-0x0000000004E00000-0x0000000004E4C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/5096-11-0x000000007465E000-0x000000007465F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5096-12-0x0000000074650000-0x0000000074E00000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.