| File name: | Cibersity.exe |
| Full analysis: | https://app.any.run/tasks/3231e09f-222c-43a5-a381-ca2259df29f3 |
| Verdict: | Malicious activity |
| Threats: | RedLine Stealer is a malicious program that collects users’ confidential data from browsers, systems, and installed software. It also infects operating systems with other malware. |
| Analysis date: | January 07, 2024, 04:07:58 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | A3619854525630026F2DF50838380682 |
| SHA1: | 2010067183D7F92C1026D72F6473B85A2E5DC739 |
| SHA256: | C8F7CEF323792B6B8BF74024704AD6ADD92B48D81C853B6CF41456BCC3519B10 |
| SSDEEP: | 98304:kY3YoG2UIhpgIlWR3CZXu4w+S+GHETjHlR6a1+p+fisAu9EByO+4lB2eMNpEAc7V:KGX |
MALICIOUS
REDLINE has been detected (YARA)
- Cibersity.exe (PID: 2040)
Actions looks like stealing of personal data
- Cibersity.exe (PID: 2040)
SUSPICIOUS
Reads the BIOS version
- Cibersity.exe (PID: 2040)
Reads settings of System Certificates
- Cibersity.exe (PID: 2040)
Searches for installed software
- Cibersity.exe (PID: 2040)
Reads browser cookies
- Cibersity.exe (PID: 2040)
Reads the Internet Settings
- Cibersity.exe (PID: 2040)
INFO
Reads product name
- Cibersity.exe (PID: 2040)
Checks supported languages
- Cibersity.exe (PID: 2040)
Reads the computer name
- Cibersity.exe (PID: 2040)
Drops the executable file immediately after the start
- Cibersity.exe (PID: 2040)
Reads the machine GUID from the registry
- Cibersity.exe (PID: 2040)
Reads Environment values
- Cibersity.exe (PID: 2040)
REDLINE has been detected (SURICATA)
- Cibersity.exe (PID: 2040)
Connects to the CnC server
- Cibersity.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
RedLine
(PID) Process(2040) Cibersity.exe
C2 (1)91.92.245.15:80
Botnet24k
Options
ErrorMessage
Keys
XorZodiacal
TRiD
| .dll | | | Win32 Dynamic Link Library (generic) (43.5) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (29.8) |
| .exe | | | Generic Win/DOS Executable (13.2) |
| .exe | | | DOS Executable Generic (13.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2088:11:16 00:07:22+01:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 188928 |
| InitializedDataSize: | 1361920 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x5d2d68 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.3.6.0 |
| ProductVersionNumber: | 2.3.6.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | Ensamblado AplicacionCibersity |
| CompanyName: | Grupo Futuver |
| FileDescription: | AplicacionCibersity |
| FileVersion: | 2.3.6.0 |
| InternalName: | Cibersity.exe |
| LegalCopyright: | Copyright Futuver 2018 |
| LegalTrademarks: | Futuver |
| OriginalFileName: | Cibersity.exe |
| ProductName: | CIBERSITY |
| ProductVersion: | 2.3.6.0 |
| AssemblyVersion: | 2.3.6.0 |
Total processes
35
Monitored processes
1
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2040 | "C:\Users\admin\Desktop\Cibersity.exe" | C:\Users\admin\Desktop\Cibersity.exe | explorer.exe | ||||||||||||
User: admin Company: Grupo Futuver Integrity Level: MEDIUM Description: AplicacionCibersity Exit code: 0 Version: 2.3.6.0 Modules
RedLine(PID) Process(2040) Cibersity.exe C2 (1)91.92.245.15:80 Botnet24k Options ErrorMessage Keys XorZodiacal | |||||||||||||||
Total events
4 293
Read events
4 261
Write events
14
Delete events
18
Modification events
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFilesHash |
Value: EFFFEBAE5FF62A6E368D565475AEB6539B7BEDB57FC98C4818A958087FB65C2F | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFiles0000 |
Value: C:\Users\admin\AppData\Local\Google\Chrome\User Data\lockfile | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | SessionHash |
Value: 30F5B576063C957C39F90D8E730F78347FE9B6B4DDD4B153FF698A6032FA422A | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | Owner |
Value: F80700009EB7591E1F41DA01 | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFilesHash |
Value: DB6109A70A666DF450A7B4293CAC0C6AD8F6D38507A1D3E112BE2AD29A6580BB | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFiles0000 |
Value: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\lockfile | |||
| (PID) Process: | (2040) Cibersity.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | SessionHash |
Value: E6AD51D7B020BC59A73FAF2686378B3D5215D9BFE7BA4E9856FCAD491F0A0DB7 | |||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
1
Threats
25
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2040 | Cibersity.exe | 91.92.245.15:80 | — | Natskovi & Sie Ltd. | BG | malicious |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2040 | Cibersity.exe | 104.26.12.31:443 | api.ip.sb | CLOUDFLARENET | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.ip.sb |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2040 | Cibersity.exe | Potentially Bad Traffic | ET INFO Microsoft net.tcp Connection Initialization Activity |
2040 | Cibersity.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 7 |
2040 | Cibersity.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2040 | Cibersity.exe | A Network Trojan was detected | ET MALWARE [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) |
2040 | Cibersity.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC - Id1Response |
2040 | Cibersity.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2040 | Cibersity.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2040 | Cibersity.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2040 | Cibersity.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2040 | Cibersity.exe | A Network Trojan was detected | ET MALWARE Redline Stealer TCP CnC Activity |
2 ETPRO signatures available at the full report