Deep Malware Analysis of 683e2c4091b8947da3a092749bf2c12e | md5: 683e2c4091b8947da3a092749bf2c12e | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | RAT | Stealer | Malicious | RedLine Stealer | RECORDSTEALER | Win 64 Exe | x64 | .Net | SOS: 0.26

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	683e2c4091b8947da3a092749bf2c12e
Sha1	1ade715cb9aff73be53a066f1ff6308f8997e1b2
Sha256	4f1271f35cb5bfdb456481302e219e5b8e7341bf1e871bd5f4cdc6636da18929
Sha384	2661801bfd92b5a5fad8b0a1cbf3408652336d7a3b602cf6fac143041cec20491f57c7cf0c70277298462ba893d8bba3
Sha512	b88bc3e9a1d246452225f428467c47934eaefc73612f3f796d97854485693fa28ecedc6be1625d8e1075b0c841c0f0b92bfc9b7ce8014f4e197846670da93e8e
SSDeep	3072:oXMDFq93bh3Injd7mWOCAlfPdNvVU1m2iQeY/A1YWMcoqwYCEw+nrKOzQGXu7MTL:ocDFqTdlfP/vVUuQjrWMGNrKOzQGX9L
TLSH	ED649D1877E89A01C27A4379E9B1C37057B4EC562A53D31B1BC4ECDB3E76B814E80A76

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path pe:exe>pe:rsrc>img

Shape pe:exe>pe:rsrc>img

malicious 3 nodes

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
[Configuration Module Name]	Arghuhuhuhu
[Configuration Module Full Name]	Arghuhuhuhu
IP	127.huhuhuhuhuhuhu
ID	thuhuhuhu
Message
Key
PublicKeyXml	<RSAKehuhuhuhuhuhuhuhuhuhuhu
Version	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
[Configuration Module Name]	Arghuhuhuhu
[Configuration Module Full Name]	Arghuhuhuhu
Key
PublicKeyXml	<RSAKehuhuhuhuhuhuhuhuhuhuhu
Version	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	RuntimeHost.exe
Full Name	RuntimeHost.exe
EntryPoint	System.Void Program::Main()
Scope Name	RuntimeHost.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	RuntimeHost
Assembly Version	10.0.21074.151
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6.2
Total Strings	380
Main Method	System.Void Program::Main()
Main IL Instruction Count	11
Main IL	`nop <null> nop <null> call System.Void Program2::WriteLine() nop <null> nop <null> leave.s IL_0010: ret pop <null> nop <null> nop <null> leave.s IL_0010: ret ret <null>`