Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
ac1906fa0c648d42c3e1b0c7b70b0e7c0c68888d90dc48c81b225f0932cdb258.exe
Resource
win10-20220812-en
Target
ac1906fa0c648d42c3e1b0c7b70b0e7c0c68888d90dc48c81b225f0932cdb258
Size
112KB
MD5
952abab48bb5bf1cf5f8fc585af985c4
SHA1
bab0ddca75b73a8ccb7f24f4abb1e22d67bec7d4
SHA256
ac1906fa0c648d42c3e1b0c7b70b0e7c0c68888d90dc48c81b225f0932cdb258
SHA512
259b01ce8950e9a4f9c2f24525515e7b61e904090c8d499f40c0430b7af5ca3ef533ed5fa84899c50c0c19087409db47c2e72eb7ac2b6aa98a4eb7b43d56573b
SSDEEP
3072:hcvFBACYCpiTI/PG/bbd1HkQcJMsDUha4EASN01i04:hcveo6bdJ9cZUha4jSoJ4
redline
paint
193.233.193.0:4633
70b295da5ec4f38705304ce3bcd32753
resource | yara_rule |
---|---|
sample | family_redline |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
CN=AMCERT\,LLC,O=AMCERT\,LLC,ST=Erevan,C=AM
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ