Behavioral task
behavioral1
Sample
0e141b028d4745d2ed54b82d53c9690f0049b0ce35120100eab2dd15f9958576.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e141b028d4745d2ed54b82d53c9690f0049b0ce35120100eab2dd15f9958576.exe
Resource
win10v2004-20220901-en
General
-
Target
0e141b028d4745d2ed54b82d53c9690f0049b0ce35120100eab2dd15f9958576.exe.bin
-
Size
137KB
-
MD5
58377a178d7a2af2f288caf7bfa0cef3
-
SHA1
cceb864d2ef71ff62975b9f2d549abb8ecbc8d56
-
SHA256
0e141b028d4745d2ed54b82d53c9690f0049b0ce35120100eab2dd15f9958576
-
SHA512
399def834f17125adb2e49a2b4d13828c2307eff44ae470fbeb6456d1e5916cd2ba2bca3d5d6cf3dfd215ca7f197e2e7be4040e92215cd23ee517266df4cd6f2
-
SSDEEP
3072:ZYO/ZMTFo/4Y7DcNtoUVN5VgDFaywPnhISSB63:ZYMZMBo/4YkroUVN0Honh5
Malware Config
Extracted
redline
Games
94.131.107.33:2079
-
auth_value
f4c8b76c81c869dcbb6d29f40358e564
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
0e141b028d4745d2ed54b82d53c9690f0049b0ce35120100eab2dd15f9958576.exe.bin.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ