Behavioral task
behavioral1
Sample
e0dc8307e639b6706b4763934d38065135c83561c432031d10c5d715dae73ce3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e0dc8307e639b6706b4763934d38065135c83561c432031d10c5d715dae73ce3.exe
Resource
win10v2004-20220812-en
General
-
Target
e0dc8307e639b6706b4763934d38065135c83561c432031d10c5d715dae73ce3.exe
-
Size
175KB
-
MD5
45fc2826c158a3dd2ffb50f756f3f389
-
SHA1
ba204160179b871b1e25976db30888d0f8114935
-
SHA256
e0dc8307e639b6706b4763934d38065135c83561c432031d10c5d715dae73ce3
-
SHA512
59a1cad96c0c4728b43113963073c545b0d228f6dbe2090a562a902bb3db81c46f2c7d527496f7042b1af8b97f384633d940b0393b38c408105e7bbf0370f64d
-
SSDEEP
3072:6xqZWDXaMI5ZULLX7AKQeWM9qhAbxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOQ:oqZmLr7Vzqh
Malware Config
Extracted
redline
Pto100TraF
82.115.223.15:15486
-
auth_value
fc50907e349b0b35689698d088eeccec
Signatures
-
Redline family
Files
-
e0dc8307e639b6706b4763934d38065135c83561c432031d10c5d715dae73ce3.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ