Behavioral task
behavioral1
Sample
0e5455003626e1dc16e9fa576c69446b08f30139a0e4c2946fddebe74f20ed6b.exe
Resource
win7-20220812-en
General
-
Target
0e5455003626e1dc16e9fa576c69446b08f30139a0e4c2946fddebe74f20ed6b.exe
-
Size
137KB
-
MD5
78c67fcdef9585a3a0469fd1322cc7a6
-
SHA1
d361018909aee62767fb48fb0e5f6b6ed9642305
-
SHA256
0e5455003626e1dc16e9fa576c69446b08f30139a0e4c2946fddebe74f20ed6b
-
SHA512
03818a56caa14f06afe786eae64810d7dc5ce015cb4bed3d1db36c62206c3c1c599460a2c4843298b46b25edd75e8a330566fa3ca73b1969d3d66f2c62ef6334
-
SSDEEP
3072:UYO/ZMTFxFoI4T1pvuL3XhoVbnDFryRZ4heSSBL:UYMZMBxFoIO9ujXhQwX4h
Malware Config
Extracted
redline
11.10
82.115.223.18:47594
-
auth_value
12daa6a88835747ec067b575f4164850
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
0e5455003626e1dc16e9fa576c69446b08f30139a0e4c2946fddebe74f20ed6b.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ