Behavioral task
behavioral1
Sample
b473e7f284a235de959eca6e9e86bbb0.exe
Resource
win7-20230220-en
General
-
Target
b473e7f284a235de959eca6e9e86bbb0.exe
-
Size
253KB
-
MD5
b473e7f284a235de959eca6e9e86bbb0
-
SHA1
d1ba458a94864ec580a50694c3e207c2cb95f3d9
-
SHA256
dfccf27488c757dcd05c1f5fafdb9c1b6537fdead5b47adc912fe953da86f3f0
-
SHA512
079e394ec87eb349df11fd0c026a2d3f3a4a1724962979d7560f85718ccecb195f32e56d5b53521389e73231942c5ede8b1258817c4510e8038f3c3ca326a271
-
SSDEEP
1536:Waoc0vIv8TH3nwlSDKPyekMzJPHhhajMSbV7Y/aUimdkMJrB:Toc7owl9P5kaRHRmmCEkArB
Malware Config
Extracted
redline
MYSTERIAN
212.113.116.143:29996
-
auth_value
f78c31ba5ffbbfb6c1fb1fad8bea1fc1
Signatures
-
Redline family
Files
-
b473e7f284a235de959eca6e9e86bbb0.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ