Behavioral task
behavioral1
Sample
bc2ff2eb335a461478e3f34cbbc5dda052ae7918eb88822fceafd90157cbac03.exe
Resource
win7-20230220-en
General
-
Target
bc2ff2eb335a461478e3f34cbbc5dda052ae7918eb88822fceafd90157cbac03.zip
-
Size
43KB
-
MD5
10c835af4242531c365cdb9477a654a2
-
SHA1
d7529a95c41979e6bc8407ec09b559da790c45cf
-
SHA256
0dfc3040d5379938e2e20165bf67d6822668b018894488a00a7572ab38428588
-
SHA512
3c40aed2fc6a35be0e929e2b4d7baaaf9e657c412b307b3a51e54d873c290891edeac9ac97f3ba474af15bdeeb76c6db38d674a1822c04eb092b2075808747f3
-
SSDEEP
768:Z0rOblD4544yq7yVDOFvaDwWb+hNw9aDrSS10qtkuJvfPEMvDG+5q+CxxEqCNykZ:ZR85byq7DsSwayqtxJnc5+5RCUPNyixz
Malware Config
Extracted
redline
alice
laptop-senp05hg.tailebd9d.ts.net:38192
Signatures
-
RedLine payload 1 IoCs
resource yara_rule static1/unpack001/bc2ff2eb335a461478e3f34cbbc5dda052ae7918eb88822fceafd90157cbac03 family_redline -
Redline family
-
SectopRAT payload 1 IoCs
resource yara_rule static1/unpack001/bc2ff2eb335a461478e3f34cbbc5dda052ae7918eb88822fceafd90157cbac03 family_sectoprat -
Sectoprat family
Files
-
bc2ff2eb335a461478e3f34cbbc5dda052ae7918eb88822fceafd90157cbac03.zip.zip
Password: infected
-
bc2ff2eb335a461478e3f34cbbc5dda052ae7918eb88822fceafd90157cbac03.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ