Behavioral task
behavioral1
Sample
IFUNEMO.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
IFUNEMO.exe
Resource
win10v2004-20220901-en
General
-
Target
IFUNEMO.html
-
Size
137KB
-
MD5
d191d53045c450435230005c5a456c61
-
SHA1
f645b6f376738ba8d9f10a153b0eea7ea428c51f
-
SHA256
74fafd06a9aba842fafaab7223ac2f1d59a5d1cf16dcaef3ea25d787adf9864e
-
SHA512
cce7843a5e702dab7a70f00816f1078da7fad4d413716f33d5d59b6aaa655489a6e1ffa750ff7453dfb5e9055a90f58ac64dbefdc161184d59edd79c31c8a18b
-
SSDEEP
3072:IYO/ZMTFCh9owLZQxtc/BcbrrrrB/VxDFtyRXdhySS9C:IYMZMBCh9oSQ3c/Bc5yBdh
Malware Config
Extracted
redline
@waruby
94.131.107.33:2079
-
auth_value
2579bbde87f82b72c1dfb2338a05b98d
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
IFUNEMO.html.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ