Behavioral task
behavioral1
Sample
HEUR-Trojan-PSW.MSIL.Reline.gen-69b3211f85045038697487812406d2fcdb74ebe68df661f60796b4a61dc0c276.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan-PSW.MSIL.Reline.gen-69b3211f85045038697487812406d2fcdb74ebe68df661f60796b4a61dc0c276.exe
Resource
win10v2004-20221111-en
General
-
Target
HEUR-Trojan-PSW.MSIL.Reline.gen-69b3211f85045038697487812406d2fcdb74ebe68df661f60796b4a61dc0c276.exe
-
Size
98KB
-
MD5
2c530deb5d4cd0f5a24739f9a422d952
-
SHA1
d4ad636c5896795fec5d26a64597b3a489d84626
-
SHA256
69b3211f85045038697487812406d2fcdb74ebe68df661f60796b4a61dc0c276
-
SHA512
af3dfc5b68c98d2539a3ece04a6c275272d81b767f9ebd77cc4d27a38f2d413847e2fcbd10697ba30bd5ebd89afe0fcfba585ce0159e9b83162214e8f02b787c
-
SSDEEP
1536:gG6ijoigpqFOLap5BqXo3I0igdcVVlmbfaxv0ujXyyedOC4EwEEg:+mEXo3IOdcos0ujyzdag
Malware Config
Extracted
redline
RZaqwrdCF
redline54376876.duckdns.org:55123
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
HEUR-Trojan-PSW.MSIL.Reline.gen-69b3211f85045038697487812406d2fcdb74ebe68df661f60796b4a61dc0c276.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ