ScreenShot
| Created | 2023.11.15 07:49 | Machine | s1_win7_x6403 |
| Filename | london.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : mailcious | ||
| VT API (file) | |||
| md5 | 27137cb3cc5b6b3ef3a28ed8daf55ba7 | ||
| sha256 | 26bb80ea94240a03b487cb1f62459d06a8ba4f9abc207cb5372a49609bfbabcf | ||
| ssdeep | 6144:hNLj5wYTGkIdf487tQi2iklho8Jixi0N:h5j5wCCj3kr1f0 | ||
| imphash | c9841028b9dc21821bee70c3fbfd867e | ||
| impfuzzy | 24:ijKNDovlvHOovS2cfzZ/J3IngFQ8RyvuT4+jlYsQ:4uQcfzbQHuc+jGsQ | ||
Network IP location
Signature (15cnts)
| Level | Description |
|---|---|
| watch | Collects information about installed applications |
| watch | Communicates with host for which no DNS query was performed |
| watch | Harvests credentials from local FTP client softwares |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | One or more potentially interesting buffers were extracted |
| notice | Queries for potentially installed applications |
| notice | Steals private information from local Internet browsers |
| notice | The binary likely contains encrypted or compressed data indicative of a packer |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (4cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET INFO Microsoft net.tcp Connection Initialization Activity
ET MALWARE Redline Stealer TCP CnC Activity
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC - Id1Response
ET MALWARE Redline Stealer Activity (Response)
ET MALWARE Redline Stealer TCP CnC Activity
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC - Id1Response
ET MALWARE Redline Stealer Activity (Response)
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x40b000 GetLocalTime
0x40b004 WaitForSingleObject
0x40b008 Sleep
0x40b00c CreateThread
0x40b010 lstrlenW
0x40b014 VirtualProtect
0x40b018 GetProcAddress
0x40b01c LoadLibraryA
0x40b020 VirtualAlloc
0x40b024 GetModuleHandleA
0x40b028 FreeConsole
0x40b02c GetLastError
0x40b030 HeapFree
0x40b034 HeapAlloc
0x40b038 RtlUnwind
0x40b03c GetCommandLineA
0x40b040 HeapCreate
0x40b044 VirtualFree
0x40b048 DeleteCriticalSection
0x40b04c LeaveCriticalSection
0x40b050 EnterCriticalSection
0x40b054 HeapReAlloc
0x40b058 GetModuleHandleW
0x40b05c ExitProcess
0x40b060 WriteFile
0x40b064 GetStdHandle
0x40b068 GetModuleFileNameA
0x40b06c TlsGetValue
0x40b070 TlsAlloc
0x40b074 TlsSetValue
0x40b078 TlsFree
0x40b07c InterlockedIncrement
0x40b080 SetLastError
0x40b084 GetCurrentThreadId
0x40b088 InterlockedDecrement
0x40b08c SetUnhandledExceptionFilter
0x40b090 FreeEnvironmentStringsA
0x40b094 GetEnvironmentStrings
0x40b098 FreeEnvironmentStringsW
0x40b09c WideCharToMultiByte
0x40b0a0 GetEnvironmentStringsW
0x40b0a4 SetHandleCount
0x40b0a8 GetFileType
0x40b0ac GetStartupInfoA
0x40b0b0 QueryPerformanceCounter
0x40b0b4 GetTickCount
0x40b0b8 GetCurrentProcessId
0x40b0bc GetSystemTimeAsFileTime
0x40b0c0 TerminateProcess
0x40b0c4 GetCurrentProcess
0x40b0c8 UnhandledExceptionFilter
0x40b0cc IsDebuggerPresent
0x40b0d0 InitializeCriticalSectionAndSpinCount
0x40b0d4 RaiseException
0x40b0d8 GetCPInfo
0x40b0dc GetACP
0x40b0e0 GetOEMCP
0x40b0e4 IsValidCodePage
0x40b0e8 HeapSize
0x40b0ec GetLocaleInfoA
0x40b0f0 GetStringTypeA
0x40b0f4 MultiByteToWideChar
0x40b0f8 GetStringTypeW
0x40b0fc LCMapStringA
0x40b100 LCMapStringW
EAT(Export Address Table) is none
KERNEL32.dll
0x40b000 GetLocalTime
0x40b004 WaitForSingleObject
0x40b008 Sleep
0x40b00c CreateThread
0x40b010 lstrlenW
0x40b014 VirtualProtect
0x40b018 GetProcAddress
0x40b01c LoadLibraryA
0x40b020 VirtualAlloc
0x40b024 GetModuleHandleA
0x40b028 FreeConsole
0x40b02c GetLastError
0x40b030 HeapFree
0x40b034 HeapAlloc
0x40b038 RtlUnwind
0x40b03c GetCommandLineA
0x40b040 HeapCreate
0x40b044 VirtualFree
0x40b048 DeleteCriticalSection
0x40b04c LeaveCriticalSection
0x40b050 EnterCriticalSection
0x40b054 HeapReAlloc
0x40b058 GetModuleHandleW
0x40b05c ExitProcess
0x40b060 WriteFile
0x40b064 GetStdHandle
0x40b068 GetModuleFileNameA
0x40b06c TlsGetValue
0x40b070 TlsAlloc
0x40b074 TlsSetValue
0x40b078 TlsFree
0x40b07c InterlockedIncrement
0x40b080 SetLastError
0x40b084 GetCurrentThreadId
0x40b088 InterlockedDecrement
0x40b08c SetUnhandledExceptionFilter
0x40b090 FreeEnvironmentStringsA
0x40b094 GetEnvironmentStrings
0x40b098 FreeEnvironmentStringsW
0x40b09c WideCharToMultiByte
0x40b0a0 GetEnvironmentStringsW
0x40b0a4 SetHandleCount
0x40b0a8 GetFileType
0x40b0ac GetStartupInfoA
0x40b0b0 QueryPerformanceCounter
0x40b0b4 GetTickCount
0x40b0b8 GetCurrentProcessId
0x40b0bc GetSystemTimeAsFileTime
0x40b0c0 TerminateProcess
0x40b0c4 GetCurrentProcess
0x40b0c8 UnhandledExceptionFilter
0x40b0cc IsDebuggerPresent
0x40b0d0 InitializeCriticalSectionAndSpinCount
0x40b0d4 RaiseException
0x40b0d8 GetCPInfo
0x40b0dc GetACP
0x40b0e0 GetOEMCP
0x40b0e4 IsValidCodePage
0x40b0e8 HeapSize
0x40b0ec GetLocaleInfoA
0x40b0f0 GetStringTypeA
0x40b0f4 MultiByteToWideChar
0x40b0f8 GetStringTypeW
0x40b0fc LCMapStringA
0x40b100 LCMapStringW
EAT(Export Address Table) is none