Behavioral task
behavioral1
Sample
6091c020ed18b12644676878dfd9d2a6f337b0aaf0d8481c53a7854834910feb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6091c020ed18b12644676878dfd9d2a6f337b0aaf0d8481c53a7854834910feb.exe
Resource
win10v2004-20220812-en
General
-
Target
6091c020ed18b12644676878dfd9d2a6f337b0aaf0d8481c53a7854834910feb.bin
-
Size
137KB
-
MD5
9f4ef3f77f317e5e452030a6c98f701a
-
SHA1
f5881bf0bbc3ed6937ab26114827aef0900d170e
-
SHA256
6091c020ed18b12644676878dfd9d2a6f337b0aaf0d8481c53a7854834910feb
-
SHA512
c7696f6a80fb240ec74240ef17ff414fa5828f098368df19879bce379097a12466e19b7b101ffcaf53a07a834caa52d43fa20749c2e334e35e55198add0e71c4
-
SSDEEP
3072:tYO/ZMTFzDaAN7s2SgkyK+tOJdVyDFpyRJPhbSSIz:tYMZMBzDaAq26+tOMOLPh
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @mr_golds)
77.73.134.27:8163
-
auth_value
4b2de03af6b6ac513ac597c2e6c1ad51
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
6091c020ed18b12644676878dfd9d2a6f337b0aaf0d8481c53a7854834910feb.bin.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ