Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-02-2025 16:26
General
-
Target
2025-02-05_80c934d251b4fedcdf50c667970446e8_bkransomware.exe
-
Size
1.8MB
-
MD5
80c934d251b4fedcdf50c667970446e8
-
SHA1
0031fa8769df956e5216196b5bf23f2b8940c962
-
SHA256
f2805d32dbfc701399716c78cfc93d0933ddd4c7e4e97fe6c2f61083b4d80543
-
SHA512
2cd144561f97f8451fee73a96e24364f84cb7b8ebe668cf354b33369c89bbb1a32d4c95d514447e3ead65ed1b6da444ebc45c2a444e0dc7d441a396147679b97
-
SSDEEP
49152:vplf1Mm6G4MjAI0PbfmzYhZw44MXZXiW2aSPSkuU8AT7U:vplfstMjlGyzYhZw44MIW2aSPSkuU80U
Malware Config
Extracted
redline
82.115.223.61:45623
-
auth_value
eb5e4bfede93853d64aa2753d5f813ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-02-05_80c934d251b4fedcdf50c667970446e8_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-05_80c934d251b4fedcdf50c667970446e8_bkransomware.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
-
Filesize
4KB
-
Filesize
208KB
-
Filesize
200KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB