Behavioral task
behavioral1
Sample
0x0007000000013397-1066.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0x0007000000013397-1066.exe
Resource
win10v2004-20230221-en
General
-
Target
0x0007000000013397-1066.dat
-
Size
175KB
-
MD5
efc2bc20da3bcef6c978112da368f78f
-
SHA1
c192dd5b289f4140a347f68a78ef906391761345
-
SHA256
5f6af6d082f5b2f977bcb890d7bcd4569f9ea6e5d061bc9f11524ffdcee5700a
-
SHA512
197b6691e996f1214ea6bc61f374aa93d4c99771947e4708f272d3e254da9ec139f6517c4d1ed1aac954e1bbc1ad1b498d3bd2ad4e34f0c2a9d2adb911da5a92
-
SSDEEP
3072:7xqZW11a2kX8fSx3IeJwewI9zhfrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOZ:NqZkSx3ZJ5zh
Malware Config
Extracted
redline
vila
193.233.20.33:4125
-
auth_value
94b115d79ddcab0a0fb9dfab8e225c3b
Signatures
-
Redline family
Files
-
0x0007000000013397-1066.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ