RedLine.E,RedLine.F | b95c8d80ccb9

Classifications

Spyware

Threat Names

RedLine.E RedLine.F

Dynamic Analysis Report

Created on 2024-05-26T15:46:55+00:00

Coalition.exe

Windows Exe (x86-32)

Filters:

File Name	Category	Type	Verdict	Actions

C:\Users\RDhJ0CNFevzX\Desktop\Coalition.exe

Sample File

Binary

MIME Type	application/vnd.microsoft.portable-executable
File Size	168.50 KB
MD5	f3d1ae2190733299cdcb9b94034cf499
SHA1	fcf82a5dd4527a8c5fb3fec9d4ef68aaf9ef6f13
SHA256	b95c8d80ccb988d87562f0a3ea91d31e0ee579320a758517e8ae77c268c9a628
SSDeep	3072:qy+CZ3TYUt6qV0Gyg+bTEOgiRt38e8h7:DXZjH06+bTEOgiRt3
ImpHash	f34d5f2d4577ed6d9ceec516c1f5a744

File Reputation Information

Verdict

Malicious

PE Information

Image Base	0x00400000
Entry Point	0x74307CEF
Size Of Code	0x00020200
Size Of Initialized Data	0x00009E00
File Type	IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem	IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type	IMAGE_FILE_MACHINE_I386
Compile Timestamp	2096-02-13 15:15 (UTC)

Version Information (11)

Comments	Helps boost CPU
CompanyName	-
FileDescription	Nirtro CPU
FileVersion	15.9.1.22
InternalName	Coalition.exe
LegalCopyright	NireoNO1 Corporation Copyright © 2021
LegalTrademarks	-
OriginalFilename	Coalition.exe
ProductName	Nitro NO2
ProductVersion	15.9.1.22
Assembly Version	1.9.2.1440

Sections (3)

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x00402000	0x000200B4	0x00020200	0x00000200	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.17
.rsrc	0x00424000	0x00009B4E	0x00009C00	0x00020400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	3.25
.reloc	0x0042E000	0x0000000C	0x00000200	0x0002A000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.1

Imports (1)

mscoree.dll (1)

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_CorExeMain	-	0x00402000	0x00022080	0x00020280	0x00000000

YARA Matches (2)

Rule Name	Rule Description	Classification	Score	Actions
RedLine_E	RedLine Stealer, RedLine.E variant	Spyware	5/5	... Actions Show Ruleset Show Match
RedLine_F	RedLine Stealer, RedLine.F variant	Spyware	5/5	... Actions Show Ruleset Show Match

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".

Before

After

WHOIS Domain Information

Screenshot

There are no files for this filter

There are no files in this analysis

Classifications

Threat Names

Before

After

WHOIS Domain Information