Behavioral task
behavioral1
Sample
0x0009000000012735-2289.exe
Resource
win7-20230220-en
General
-
Target
0x0009000000012735-2289.dat
-
Size
168KB
-
MD5
9769c25c4a15b0c8af084316d51ab586
-
SHA1
d9df15e4232d136ece8bc89354036adfdc3ec069
-
SHA256
06b517e81040b5c3fc27adb0c5cfbc05b6082a88d3e6087bb2f3f8e941e22913
-
SHA512
cffddfb5283ccae2615dd131eee23a137d9a79270295caa865d6f1cf8fa6650ed74106d41566b2d29f7dad39450e3a1feb46b9c568c4a71ba3329606fdea65a8
-
SSDEEP
1536:cx56Ng2WBqlVZRGW8AAr3D09Vbo/ofhRmdicyTGqV8bumsbOwFcEND83wYkr8e8C:cXTLL0C/qV0aXFcENDd8e8h0
Malware Config
Extracted
redline
losk
185.161.248.150:4128
-
auth_value
c0a6c391e53d2d9cd27bb17d1d38ada3
Signatures
-
Redline family
Files
-
0x0009000000012735-2289.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ