redlin[.]zip | Triage™

Resubmissions

23/01/2023, 07:28

230123-jarzrscc681

23/01/2023, 06:56

230123-hqvvxsdh6t10

23/01/2023, 05:09

230123-ftaytabg3410

Sharing

Copy URL Twitter E-mail

General

Target
redlin.zip
Size 2.9MB
Sample230123-ftaytabg34
SHA256 f0e385eb75d80979811cf12c9dec3899ef724d1fba94ee5cd314c22e2df07377
MD5 20a918e8de8f6abc3f9ad5aaa0f8ab6b
SHA1 c73d97926e71d9577f8bf065a77abc82532a07af
SHA512 a76522a9af082f49c9a6e3be9c2eae123d1e54e1e5408a189e3c55d6d47b91d1e169a0d5346c6f6a2f764e49bfd577dbdfa4809251a7b3373a0986d8104c4838
SSDEEP 49152:C3arM3rBXWHDMzpUSngO8nChuH3CPmTq8dbZY5/pDMZzEmiLnFSMckQ8Xa/ZGJqJ:garM7BSMzpyOmChuHSOTqsbZY5/tEpiE
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

redlin.zip

.zip 2.9MB
cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4.exe

.exe 3.0MB

redlin.zip

SHA256 f0e385eb75d80979811cf12c9dec3899ef724d1fba94ee5cd314c22e2df07377
MD5 20a918e8de8f6abc3f9ad5aaa0f8ab6b
SHA1 c73d97926e71d9577f8bf065a77abc82532a07af
SHA512 a76522a9af082f49c9a6e3be9c2eae123d1e54e1e5408a189e3c55d6d47b91d1e169a0d5346c6f6a2f764e49bfd577dbdfa4809251a7b3373a0986d8104c4838
SSDEEP 49152:C3arM3rBXWHDMzpUSngO8nChuH3CPmTq8dbZY5/pDMZzEmiLnFSMckQ8Xa/ZGJqJ:garM7BSMzpyOmChuHSOTqsbZY5/tEpiE
MD5 SHA1 SHA512 SSDEEP

Password

infected

cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4.exe

IMPHASH 32569d67dc210c5cb9a759b08da2bdb3
SHA256 cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
MD5 74231678f536a19b3016840f56b845c7
SHA1 a5645777558a7d5905e101e54d61b0c8c1120de3
SHA512 4117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
SSDEEP 49152:xcBNPkZVi7iKiF8cUvFyPITKyMZOf+BFkUTQktm3II/M01KEwJ84vLRaBtIl9mT9:xNri7ixZUvFyPIpbfwF1UjIn01hCvLU9
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

infected

Minor OS version

Major OS version

Entry point

102668

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysStringLen SysAllocStringLen VariantClear

user32

DialogBoxParamW SetWindowLongW GetWindowLongW GetDlgItem LoadStringW CharUpperW DestroyWindow EndDialog PostMessageW SetWindowTextW ShowWindow MessageBoxW SendMessageW LoadIconW KillTimer SetTimer

shell32

ShellExecuteExW

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex memset wcsstr free malloc memcpy _CxxThrowException _purecall memmove memcmp wcscmp __CxxFrameHandler

kernel32

WaitForSingleObject GetStartupInfoA InitializeCriticalSection ResetEvent SetEvent CreateEventW lstrlenW lstrcatW VirtualFree VirtualAlloc Sleep WaitForMultipleObjects GetFileInformationByHandle GetStdHandle GlobalMemoryStatus GetSystemInfo GetCurrentProcess GetProcessAffinityMask SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize GetFileAttributesW GetModuleHandleA FindNextFileW FindFirstFileW FindClose GetCurrentThreadId GetTickCount GetCurrentProcessId GetTempPathW GetCurrentDirectoryW SetCurrentDirectoryW SetLastError DeleteFileW CreateDirectoryW GetModuleHandleW GetProcAddress RemoveDirectoryW SetFileAttributesW CreateFileW SetFileTime GetSystemDirectoryW FormatMessageW LocalFree GetModuleFileNameW LoadLibraryExW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError GetVersionExW GetCommandLineW CreateProcessW CloseHandle