Behavioral task
behavioral1
Sample
si868271.exe
Resource
win7-20230220-en
General
-
Target
si868271.exe
-
Size
175KB
-
MD5
7c11dfe7837f2079d50113de0e973682
-
SHA1
fae072addd4d56ab67d08ab82da4aac5d7223960
-
SHA256
442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
-
SHA512
06085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
SSDEEP
3072:ExqZWJBaKULo3I56dWte75FNhUjxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuL:aqZIYSfNh
Malware Config
Extracted
redline
hero
193.233.20.31:4125
-
auth_value
11f3c75a88ca461bcc8d6bf60a1193e3
Signatures
-
Redline family
Files
-
si868271.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ