Behavioral task
behavioral1
Sample
50fa028368e760bc85d0216e2ad6f80446fe8698804d8d3cfadbf83481ba68e2.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
50fa028368e760bc85d0216e2ad6f80446fe8698804d8d3cfadbf83481ba68e2.exe
Resource
win10v2004-20230703-en
General
-
Target
a4341997cbad7d63be6f3a07b9783804.bin
-
Size
129KB
-
MD5
7cbf359e0ec6f41d2836442dcb6bba0f
-
SHA1
030348e2b22c09dc2541afaaed5773f2a102608c
-
SHA256
02e485cce51838237205e1b9defdc0d709542eaf9f3ef54c3dde1f2f5e5f615f
-
SHA512
67c751cb0e4296671fb61168f7f81756d94814564760e52e0025b427699664be51d77f7f7f4d54ca50840e96e75f4412aaf270b642774f811e81675946c8a5dd
-
SSDEEP
3072:CsvgVk0w8T7S7ayMVaex28mXB3Z8caJaVxjPvuv8d:tYVFw8T7S2yqO8mPbxjP20d
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule static1/unpack001/50fa028368e760bc85d0216e2ad6f80446fe8698804d8d3cfadbf83481ba68e2.exe family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/50fa028368e760bc85d0216e2ad6f80446fe8698804d8d3cfadbf83481ba68e2.exe
Files
-
a4341997cbad7d63be6f3a07b9783804.bin.zip
Password: infected
-
50fa028368e760bc85d0216e2ad6f80446fe8698804d8d3cfadbf83481ba68e2.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 300KB - Virtual size: 299KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ