Behavioral task
behavioral1
Sample
B35471B960167B43427EA4B984A602FF.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
B35471B960167B43427EA4B984A602FF.exe
Resource
win10v2004-20230915-en
General
-
Target
B35471B960167B43427EA4B984A602FF.exe
-
Size
221KB
-
MD5
b35471b960167b43427ea4b984a602ff
-
SHA1
f22b73efc63b3a640845a895e7421f9bc3c51727
-
SHA256
6379bf3bac6025e6ec0441f9a56f5ac9a4fc74b516fdfb64c0d351c5e22b02db
-
SHA512
4c9a08c3832bfa35a26f2e206ddf391a7b27015480feec56dda1fab5f68980e1c5b843f8dbe5199dca2572bdf3acbfe42a363f3c24fcc3b5f1b0ae634e4407cb
-
SSDEEP
3072:ftoVsx0nhNgc40Om82pwt3g7t/qFHVlJPQ3OHSbajt:1gsChNgc4Vm8C5/G1lJPqcSba
Malware Config
Extracted
redline
45.81.39.134:24980
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource B35471B960167B43427EA4B984A602FF.exe
Files
-
B35471B960167B43427EA4B984A602FF.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ