Behavioral task
behavioral1
Sample
49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d.exe
Resource
win7-20220812-en
General
-
Target
49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d.exe
-
Size
359KB
-
MD5
3bbcec2e0e798d9858d54a1dfe062d9c
-
SHA1
fe19a2ee81fca8759bef63ea743d586d86817fdd
-
SHA256
49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d
-
SHA512
49e863202e0b29bf59d9e7e5b5487fb12ac6b9302f883ae48e187c2d430a5878561b786614f3ad1e49aaf6ea9c7cecc9a01bf9f79fd2635123b731b1212fde3b
-
SSDEEP
6144:NS5A8N5MbYMcNDGOg4WOKmwoUxAlpo3JDDx21eqE6Vz7X5rRd2nJHcpajZ9rU+w/:uYYbaO6etUOwDx21eqE6Vz7X5rRd2nJK
Malware Config
Extracted
redline
+new10
95.217.81.67:15781
-
auth_value
71466e289c1fa2064de510a850454a2a
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
49e4eb7458946b065eccf54804896b3c575b1661fe8bde38987214086be5ce2d.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 355KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ