Behavioral task
behavioral1
Sample
a8c498f5129af0229081edf1e535ac9dab6ad568befcbcecbfc7cc4c61e0a8eb.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
a8c498f5129af0229081edf1e535ac9dab6ad568befcbcecbfc7cc4c61e0a8eb.exe
Resource
win10v2004-20220721-en
General
-
Target
a8c498f5129af0229081edf1e535ac9dab6ad568befcbcecbfc7cc4c61e0a8eb.bin
-
Size
272KB
-
MD5
e51a01ba614be4e35cf11d4a238ef1d8
-
SHA1
6c5e5f374ecec51e689653f900fb60cf12cdc00c
-
SHA256
690b606175172408c371394eb97b603e7854e3c91372dfdf78dfa47c3670418c
-
SHA512
3431f67d0ad1a7b95bd6a6a64359fddae6acba880dd847a257983d0003f4d80ff6ccc7d296cede4ba8647523ae3620ef38dd70b9f51f84ccad66a233ea71b806
-
SSDEEP
6144:loH3+tFwKnLh6vDfNIslQLm3twDJshKZAdAq:iqwS6vLNIslQLm3twDJshKZAdV
Malware Config
Extracted
redline
TPB-ACTIVATOR
amrican-sport-live-stream.cc:4581
-
auth_value
df7c91432437b11d8f25d54ba7832b8d
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
a8c498f5129af0229081edf1e535ac9dab6ad568befcbcecbfc7cc4c61e0a8eb.bin.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 242KB - Virtual size: 241KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ