Behavioral task
behavioral1
Sample
0x0006000000023256-276.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0x0006000000023256-276.exe
Resource
win10v2004-20230915-en
General
-
Target
0x0006000000023256-276.dat
-
Size
221KB
-
MD5
cd2161566cbd905994e2f27b878bdc84
-
SHA1
4977c582672247f9eb43e27440cccc22ccb4a3a0
-
SHA256
5aaaa09e3f6fb7672d1f77d3652a4392ca14643f7735795d55ce4767aa291d74
-
SHA512
8cbf2d7e8ca2d6ab9cf8be78e7c1a3a90539c31a24efa46ddf73a05eeb07960b0a6a5f5bd27cc86778dbd8cea842ec9bf7e1450f59dc625549c2d428fb60166c
-
SSDEEP
3072:TtJXRMeZYncNgckxQdxCr1d2t/q5yoQVZL53pRzzXZQAZ:TJMeucNgckedxCDo/doQVZdZRzzXZQ
Malware Config
Extracted
redline
kukish
77.91.124.55:19071
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x0006000000023256-276.dat
Files
-
0x0006000000023256-276.dat.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ