Edit tour

Windows Analysis Report
VBY5zBdZox

Overview

General Information

Sample Name:	VBY5zBdZox (renamed file extension from none to exe)
Analysis ID:	651254
MD5:	acc0fb4cb35df2d49fc609f2e299ed5e
SHA1:	fff261da7332d1bef4253539c3217dcedce99a17
SHA256:	907b6500dba0a048d51a3381fafed7e8b6eb256381f53c6471ebb6d305fddfd4
Tags:	32exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Detected unpacking (changes PE section rights)

Snort IDS alert for network traffic

Tries to steal Crypto Currency Wallets

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Yara detected Generic Downloader

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

Yara detected Credential Stealer

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

VBY5zBdZox.exe (PID: 3176 cmdline: "C:\Users\user\Desktop\VBY5zBdZox.exe" MD5: ACC0FB4CB35DF2D49FC609F2E299ED5E)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["193.106.191.246:23196"], "Bot Id": "RUZKI", "Authorization Header": "121027c094f768a0a0e9b562f6417952"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.314646008.0000000005150000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.314646008.0000000005150000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.314646008.0000000005150000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x27856:$pat14: , CommandLine: 0x1c01a:$v2_1: ListOfProcesses 0x1b7bd:$v4_3: base64str 0x1b78a:$v4_4: stringKey 0x1b7c7:$v4_5: BytesToStringConverted 0x1b7b2:$v4_6: FromBase64 0x1bcd5:$v4_8: procName 0x1991d:$v5_7: RecordHeaderField 0x19859:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000000.00000002.305431311.0000000002950000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.305431311.0000000002950000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.305431311.0000000002950000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2873e:$pat14: , CommandLine: 0x1cf02:$v2_1: ListOfProcesses 0x1c6a5:$v4_3: base64str 0x1c672:$v4_4: stringKey 0x1c6af:$v4_5: BytesToStringConverted 0x1c69a:$v4_6: FromBase64 0x1cbbd:$v4_8: procName 0x1a805:$v5_7: RecordHeaderField 0x1a741:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000000.00000003.239424643.00000000027D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.239424643.00000000027D0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 87 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000000.00000002.301936626.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.301936626.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 87 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000000.00000002.303381786.0000000002790000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.306212179.0000000002A23000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.240106550.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.310555251.0000000002D75000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VBY5zBdZox.exe PID: 3176	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: VBY5zBdZox.exe PID: 3176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.VBY5zBdZox.exe.27d0000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.VBY5zBdZox.exe.27d0000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 87 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.VBY5zBdZox.exe.2950ee8.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2950ee8.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25a56:$pat14: , CommandLine: 0x1a21a:$v2_1: ListOfProcesses 0x199bd:$v4_3: base64str 0x1998a:$v4_4: stringKey 0x199c7:$v4_5: BytesToStringConverted 0x199b2:$v4_6: FromBase64 0x19ed5:$v4_8: procName 0x17b1d:$v5_7: RecordHeaderField 0x17a59:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.2a63a26.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2a63a26.5.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2693e:$pat14: , CommandLine: 0x1b102:$v2_1: ListOfProcesses 0x1a8a5:$v4_3: base64str 0x1a872:$v4_4: stringKey 0x1a8af:$v4_5: BytesToStringConverted 0x1a89a:$v4_6: FromBase64 0x1adbd:$v4_8: procName 0x18a05:$v5_7: RecordHeaderField 0x18941:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.5150000.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.5150000.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VBY5zBdZox.exe.5150000.6.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x27856:$pat14: , CommandLine: 0x1c01a:$v2_1: ListOfProcesses 0x1b7bd:$v4_3: base64str 0x1b78a:$v4_4: stringKey 0x1b7c7:$v4_5: BytesToStringConverted 0x1b7b2:$v4_6: FromBase64 0x1bcd5:$v4_8: procName 0x1991d:$v5_7: RecordHeaderField 0x19859:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.3.VBY5zBdZox.exe.c15928.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.VBY5zBdZox.exe.c15928.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25a56:$pat14: , CommandLine: 0x1a21a:$v2_1: ListOfProcesses 0x199bd:$v4_3: base64str 0x1998a:$v4_4: stringKey 0x199c7:$v4_5: BytesToStringConverted 0x199b2:$v4_6: FromBase64 0x19ed5:$v4_8: procName 0x17b1d:$v5_7: RecordHeaderField 0x17a59:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.2950000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2950000.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2693e:$pat14: , CommandLine: 0x1b102:$v2_1: ListOfProcesses 0x1a8a5:$v4_3: base64str 0x1a872:$v4_4: stringKey 0x1a8af:$v4_5: BytesToStringConverted 0x1a89a:$v4_6: FromBase64 0x1adbd:$v4_8: procName 0x18a05:$v5_7: RecordHeaderField 0x18941:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.2a6490e.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2a6490e.4.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25a56:$pat14: , CommandLine: 0x1a21a:$v2_1: ListOfProcesses 0x199bd:$v4_3: base64str 0x1998a:$v4_4: stringKey 0x199c7:$v4_5: BytesToStringConverted 0x199b2:$v4_6: FromBase64 0x19ed5:$v4_8: procName 0x17b1d:$v5_7: RecordHeaderField 0x17a59:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.2950000.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2950000.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VBY5zBdZox.exe.2950000.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2873e:$pat14: , CommandLine: 0x1cf02:$v2_1: ListOfProcesses 0x1c6a5:$v4_3: base64str 0x1c672:$v4_4: stringKey 0x1c6af:$v4_5: BytesToStringConverted 0x1c69a:$v4_6: FromBase64 0x1cbbd:$v4_8: procName 0x1a805:$v5_7: RecordHeaderField 0x1a741:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 87 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.VBY5zBdZox.exe.2a6490e.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2a6490e.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VBY5zBdZox.exe.2a6490e.4.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x27856:$pat14: , CommandLine: 0x1c01a:$v2_1: ListOfProcesses 0x1b7bd:$v4_3: base64str 0x1b78a:$v4_4: stringKey 0x1b7c7:$v4_5: BytesToStringConverted 0x1b7b2:$v4_6: FromBase64 0x1bcd5:$v4_8: procName 0x1991d:$v5_7: RecordHeaderField 0x19859:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.5150000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.5150000.6.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x25a56:$pat14: , CommandLine: 0x1a21a:$v2_1: ListOfProcesses 0x199bd:$v4_3: base64str 0x1998a:$v4_4: stringKey 0x199c7:$v4_5: BytesToStringConverted 0x199b2:$v4_6: FromBase64 0x19ed5:$v4_8: procName 0x17b1d:$v5_7: RecordHeaderField 0x17a59:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 87 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0.2.VBY5zBdZox.exe.2a63a26.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2a63a26.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VBY5zBdZox.exe.2a63a26.5.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2873e:$pat14: , CommandLine: 0x1cf02:$v2_1: ListOfProcesses 0x1c6a5:$v4_3: base64str 0x1c672:$v4_4: stringKey 0x1c6af:$v4_5: BytesToStringConverted 0x1c69a:$v4_6: FromBase64 0x1cbbd:$v4_8: procName 0x1a805:$v5_7: RecordHeaderField 0x1a741:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.VBY5zBdZox.exe.2790e67.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2790e67.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 87 88 44 24 2B 88 44 24 2F B0 AB 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
0.2.VBY5zBdZox.exe.2950ee8.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.VBY5zBdZox.exe.2950ee8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.VBY5zBdZox.exe.2950ee8.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x27856:$pat14: , CommandLine: 0x1c01a:$v2_1: ListOfProcesses 0x1b7bd:$v4_3: base64str 0x1b78a:$v4_4: stringKey 0x1b7c7:$v4_5: BytesToStringConverted 0x1b7b2:$v4_6: FromBase64 0x1bcd5:$v4_8: procName 0x1991d:$v5_7: RecordHeaderField 0x19859:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.3.VBY5zBdZox.exe.c15928.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.VBY5zBdZox.exe.c15928.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.VBY5zBdZox.exe.c15928.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x27856:$pat14: , CommandLine: 0x1c01a:$v2_1: ListOfProcesses 0x1b7bd:$v4_3: base64str 0x1b78a:$v4_4: stringKey 0x1b7c7:$v4_5: BytesToStringConverted 0x1b7b2:$v4_6: FromBase64 0x1bcd5:$v4_8: procName 0x1991d:$v5_7: RecordHeaderField 0x19859:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
Click to see the 33 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.4 - Destination IP: 193.106.191.246

Timestamp:	192.168.2.4193.106.191.24649758231962850027 06/23/22-17:51:27.182664
SID:	2850027
Source Port:	49758
Destination Port:	23196
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 193.106.191.246

Timestamp:	192.168.2.4193.106.191.24649758231962850286 06/23/22-17:51:29.952462
SID:	2850286
Source Port:	49758
Destination Port:	23196
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 193.106.191.246 - Destination IP: 192.168.2.4

Timestamp:	193.106.191.246192.168.2.423196497582850353 06/23/22-17:51:28.242070
SID:	2850353
Source Port:	23196
Destination Port:	49758
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: VBY5zBdZox.exe

Virustotal: Detection: 34%

Perma Link

Machine Learning detection for sample

Source: VBY5zBdZox.exe

Joe Sandbox ML: detected

Source: 0.2.VBY5zBdZox.exe.5150000.6.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["193.106.191.246:23196"], "Bot Id": "RUZKI", "Authorization Header": "121027c094f768a0a0e9b562f6417952"}

Compliance

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
VBY5zBdZox

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VBY5zBdZox

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Windows Analysis Report
VBY5zBdZox