Behavioral task
behavioral1
Sample
6405d99d707d3668c473f53b1fed527d.exe
Resource
win7-20220812-en
General
-
Target
6405d99d707d3668c473f53b1fed527d.exe
-
Size
107KB
-
MD5
6405d99d707d3668c473f53b1fed527d
-
SHA1
19f68b14137aca73527131166d51cbae981205a3
-
SHA256
954c5aaf075a4a53eab89bf117ffe10a88150a1e52569a66937a0887ba02249a
-
SHA512
64e93c0fa8402d85014244b789d6fa276f3f3848fc608317aefcc8313b5b1d6de3e493a163a734af3860347826bdee81984a1f6ea06ad08f5f391715de931c44
-
SSDEEP
3072:XcvFBgCYdpicIW1HJ5d9I1FQcmpxDuhd4EASNJ:Xcv+Qid9WucUuhd4jS
Malware Config
Extracted
redline
yt
78.153.144.20:40613
-
auth_value
ff88c2342c7904f4b4d2a8305c5568cb
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
6405d99d707d3668c473f53b1fed527d.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ