Behavioral task
behavioral1
Sample
347323f46ccfcb4dc4cf57beae4689218d691d435b307d7c5d790f3e3642ac8a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
347323f46ccfcb4dc4cf57beae4689218d691d435b307d7c5d790f3e3642ac8a.exe
Resource
win10v2004-20230220-en
General
-
Target
347323f46ccfcb4dc4cf57beae4689218d691d435b307d7c5d790f3e3642ac8a.zip
-
Size
48KB
-
MD5
70448a2922f83512b4124de99423f409
-
SHA1
db4930f9904e67e8050b2ccbf47f8698dda5853f
-
SHA256
8fb8d890b7c2838d2ed8f16c4225e557c205e469a2fed799e21d58e3e8d374e6
-
SHA512
a41d426e6f304811ba046c23c2508d0259d2378d6e59a7c2dc5193c23a774e06b083a3c0ff35260a6db513bcf4c33fba282fb2d19d527ba423bc289126dbb1de
-
SSDEEP
768:zhZPIlqs39bQkFvz7ZwLCAOkVKVXWiAolhQJLtJN936mcP8zt0IvOK4sxmKU/P:Qlqs3mY/67MWfokLvN9qm2Q0Ib4Vf
Malware Config
Extracted
redline
x19
79.137.207.219:12330
-
auth_value
122bb47b6f4062231c577633d42b1a08
Signatures
-
Redline family
Files
-
347323f46ccfcb4dc4cf57beae4689218d691d435b307d7c5d790f3e3642ac8a.zip.zip
Password: infected
-
347323f46ccfcb4dc4cf57beae4689218d691d435b307d7c5d790f3e3642ac8a.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ