Behavioral task
behavioral1
Sample
0x0009000000016ccc-90.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0x0009000000016ccc-90.exe
Resource
win10v2004-20230703-en
General
-
Target
0x0009000000016ccc-90.dat
-
Size
174KB
-
MD5
341162ac4001dc5ea120b791fd9f1236
-
SHA1
931c4d8bcd8949f51b2d7f53f8ddc21ca0a9c4db
-
SHA256
3a24a5d7fbcf29756d4d4778cc024d27598172007cb834b2f5255dd951670275
-
SHA512
75ffc97409a442609ce2c624260ee65cf00cd7c017acbb16b5a68ccc42fb6ef7a5dcd5e49a2d15f3fb74ffbabe87142aa271522f0a3434fea12f2f1d56c04606
-
SSDEEP
3072:tIjpNoqjrI0YoID6OVAe2HuNz+E0qFYcUfzQQJ88e8ha:qjpxrI0YoID4uNz+E0KUfzQQ6
Malware Config
Extracted
redline
meson
77.91.124.54:19071
-
auth_value
47ca57ebe5c142c9ad4650f71bf57877
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x0009000000016ccc-90.dat
Files
-
0x0009000000016ccc-90.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ