Behavioral task
behavioral1
Sample
41903706e727468cc2571b7a031c9bbfeb4ee3ee37abc521c09196b7bf82f992.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
41903706e727468cc2571b7a031c9bbfeb4ee3ee37abc521c09196b7bf82f992.exe
Resource
win10v2004-20230220-en
General
-
Target
156f32576e18f7ca50e41068cc9cdf00.bin
-
Size
48KB
-
MD5
5fc750534253e856aeeda7e6e8267f4d
-
SHA1
613b812b476ef03aeb8c16ce430c8e52327b395b
-
SHA256
4ca195f1c75f2fed90a651dbc265723a373a070c4c0a1a2e9938f860ac8baeaf
-
SHA512
57c676e89a6a9afb954b8b0b7fbfd0505c7fe73c805ea47677db5be2e953afcf235a826e17a107eaf1d6561e0da205f1fcab9b818678f49ec4f63cfcd8193027
-
SSDEEP
768:ZcnhRqGs1OVLFYbGsF6/SKuCZgqz7eupMm7ZXdZE5gtR2yQQYUrMnPnSUcHRhCzy:hsFaMcUXT/FpQyQxUwP8Rm4Omzrh
Malware Config
Extracted
redline
ME938AR34AedD1aVktgU7jVU63BOwx
51.81.63.206:12562
-
auth_value
04698fe47da731ceb0a486b0e4b3beb1
Signatures
-
Redline family
Files
-
156f32576e18f7ca50e41068cc9cdf00.bin.zip
Password: infected
-
41903706e727468cc2571b7a031c9bbfeb4ee3ee37abc521c09196b7bf82f992.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ