Behavioral task
behavioral1
Sample
75d21bab38dc50854b1c54991092b47c92784b9b98f5293faa93ddaa2ee6322b.exe
Resource
win7-20220901-en
General
-
Target
75d21bab38dc50854b1c54991092b47c92784b9b98f5293faa93ddaa2ee6322b.exe
-
Size
397KB
-
MD5
9659be137114d42695d75b312269f494
-
SHA1
52fede52b6c2438e1f12937431b395faec152abc
-
SHA256
75d21bab38dc50854b1c54991092b47c92784b9b98f5293faa93ddaa2ee6322b
-
SHA512
e41225d427f7ac822b16a57355ac08324e5dbbb1f691f89c9a60d282443f72597fb3deec88e8d67d883c7fa73604819bd5de99db7d058255b3841ec70858c3b1
-
SSDEEP
6144:aYMZMBKxFIS8vsIthMacxero0WWCDsDtwwGK6NsFhMgZK386f:aYGMoIt+arIWCDsDTGKzY38Y
Malware Config
Extracted
redline
hf1120
217.69.10.141:8080
-
auth_value
64f30d6fbc248c3c1ca23678657a666a
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
75d21bab38dc50854b1c54991092b47c92784b9b98f5293faa93ddaa2ee6322b.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 263KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ