Behavioral task
behavioral1
Sample
49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d.exe
Resource
win7-20220812-en
General
-
Target
49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d.zip
-
Size
162KB
-
MD5
5fe3f64794bee4e3934e78b4bdbfacbf
-
SHA1
c3bc434de1d327e03d715405dcfc95d1fde6d290
-
SHA256
5a015ee11b49711db4a7ac822e6d5bf2a60d08c4dbc62f8b4bfaea8840fae364
-
SHA512
a96c6a37c2c4f30a57f9a59ab8961a238fbc04e02d4cd72adbfe602798394b432599ff6ae5a609a8ca457dc2e175077b8bc96c6001fb86a1319ad714609d5201
-
SSDEEP
3072:dbA2F9dMRqXMlFjDHPEyk+gcq3mIkydfoS1DVyA+kQaJKjLLBz2qQ:5A2F9dmrjDHPEyk+m2IPaUVv+VacjV9Q
Malware Config
Extracted
redline
+new10
95.217.81.67:15781
-
auth_value
71466e289c1fa2064de510a850454a2a
Signatures
-
RedLine payload 1 IoCs
resource yara_rule static1/unpack001/49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d.exe family_redline -
Redline family
Files
-
49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d.zip.zip
Password: infected
-
49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 355KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ