Behavioral task
behavioral1
Sample
0x00080000000122fb-116.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0x00080000000122fb-116.exe
Resource
win10v2004-20230220-en
General
-
Target
0x00080000000122fb-116.dat
-
Size
145KB
-
MD5
ea02143ac313798985c5ed52585b428a
-
SHA1
b2e95f07ae7ea20cf7fcb98bb8925d1ffe53298d
-
SHA256
357236ee9d0eea188d9e4ae1b30211fd69b51ada5ffed7dc621090f22b89b553
-
SHA512
5fc8c57a28676c958c865a87a54faca60b319826e0f107c585ca2864d3aba97f3bef4f191ca233d0b78dac2ac3eadcc255793f6a5b25d54ea348462b9644f54b
-
SSDEEP
1536:E2BGlTP+mZP61WEYDmRSZDgQsaZJE+vZCimCemhoiQoxbudfIXAIG0wuei/g4v+2:OV+m5cRQmRSZPabJzOFQIGh+ZJ8e8hq
Malware Config
Extracted
redline
lusor
185.161.248.25:4132
-
auth_value
3dbba3970a1ecc1d78ed03874f611a75
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x00080000000122fb-116.dat
Files
-
0x00080000000122fb-116.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ