Behavioral task
behavioral1
Sample
0x00080000000122fa-116.exe
Resource
win7-20230220-en
General
-
Target
0x00080000000122fa-116.dat
-
Size
145KB
-
MD5
829704d3e543659e33af1b3569fa71d7
-
SHA1
c54de4ef9a1b6a7a15b2b18cb58b678b8ebe52e4
-
SHA256
6bce97dd1139779eb67ae95b96f89bb20a5258c66bc956470413bdf99e848664
-
SHA512
a6e0275d79de90438a670e8e1006ffeb88a28d2864ec4e94ba9b086c8b932903c7e4f923521433186a9b14f841eeb820e25aaeb8121c608b7ab2b8724a9a8bc8
-
SSDEEP
3072:lV+m5czQmRS933BaSrJVcXdhQZJ8e8hL:ljKHYUdhQz
Malware Config
Extracted
redline
motor
185.161.248.75:4132
-
auth_value
ec19ab9989a783983c5cbbc0e5ac4a5f
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x00080000000122fa-116.dat
Files
-
0x00080000000122fa-116.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ