Analysis date (UTC): 25 January 2024, 00:39Analysis environment: Windows 7 Pro, build 7601, x86

http://dw.ohuyal.xyz/download/redtail.sh

MD5:287F05CFAFFB2EDD2869DC3EC7EFBD23
SHA1:05836ECD0573B00AC76AA9B64334296B70EF508A
SHA256:B9E2385F9C280343363202F9756C67DA6B48BE6669A52158F326DEA79057E58E

Analysis result

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

No suspicious indicators.

INFO

The process uses the downloaded file

  • chrome.exe (PID: 3028)
  • chrome.exe (PID: 3660)
  • chrome.exe (PID: 2044)
  • chrome.exe (PID: 2908)
  • chrome.exe (PID: 3088)
  • chrome.exe (PID: 3044)

Manual execution by a user

  • powershell.exe (PID: 3816)
  • notepad++.exe (PID: 3624)

Executable content was dropped or overwritten

  • chrome.exe (PID: 1504)
  • chrome.exe (PID: 1624)

Drops the executable file immediately after the start

  • chrome.exe (PID: 1504)
  • chrome.exe (PID: 1624)

Application launched itself

  • chrome.exe (PID: 1936)

Threats

PIDProcessClassMessage
2240chrome.exeMisc AttackET COMPROMISED Known Compromised or Hostile Host Traffic group 16
2240chrome.exeMisc AttackET 3CORESec Poor Reputation IP group 21
2240chrome.exePotentially Bad TrafficAV INFO HTTP Request to a *.xyz domain
2240chrome.exePotentially Bad TrafficET INFO X86_64 File Download Request from IP Address
2240chrome.exePotential Corporate Privacy ViolationET POLICY Executable and linking format (ELF) file download Over HTTP
2240chrome.exePotentially Bad TrafficET HUNTING Suspicious GET Request for .i686 File
2240chrome.exePotentially Bad TrafficET HUNTING Suspicious GET Request for .arm file File
2240chrome.exePotential Corporate Privacy ViolationET POLICY Executable and linking format (ELF) file download Over HTTP
2240chrome.exePotentially Bad TrafficET INFO ARM7 File Download Request from IP Address
2240chrome.exePotentially Bad TrafficET HUNTING Suspicious GET Request for .arm file File

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN