Behavioral task
behavioral1
Sample
BLACK.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
BLACK.exe
Resource
win10v2004-20230703-en
General
-
Target
BLACK.exe
-
Size
341KB
-
MD5
37bace39942a74fbd02c012ac0901a9c
-
SHA1
42808cd145f5a25350222acb6a194421924f0407
-
SHA256
e38026f2750b8710819c91729a589c6a043721a5998766aed363feacf7550a6a
-
SHA512
370a221e1f80711fba90a776b6be4a32b852d2cd461d5bdb4793e5b3a2edb8ed7897f55d8e85f72140f2f7b02f7c9063cde1cc74557984d702be14ab6bf8bb08
-
SSDEEP
6144:OsZ3qmy8BeO4xmHVnnb3J6BYbVLf8N1a/Ti:OcqkJ4xnBYbVLfO
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BLACK.exe
Files
-
BLACK.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 301KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ