Behavioral task
behavioral1
Sample
e72d130901090a952719c918c2f288b63af9ab7d413efaf9c8c26f875f25eb9f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e72d130901090a952719c918c2f288b63af9ab7d413efaf9c8c26f875f25eb9f.exe
Resource
win10v2004-20230915-en
General
-
Target
e72d130901090a952719c918c2f288b63af9ab7d413efaf9c8c26f875f25eb9f
-
Size
221KB
-
MD5
53d5510cb71618d8f2e5bfcf4faa2893
-
SHA1
b5d64a9ad6693a2d9c192fbaf31ee25c52454814
-
SHA256
e72d130901090a952719c918c2f288b63af9ab7d413efaf9c8c26f875f25eb9f
-
SHA512
d90572392556f7e71034ff57f44685982232205badf432287790ddefff818b6ab0362a36eb48ab47b67a99198da0464fed492ffcba99557d077def9fa04823f4
-
SSDEEP
6144:mMxn3yWlNgcDmhJL2FXWiN/+o/OB9t2cT:mW33lNgcDoEnIt2cT
Malware Config
Extracted
redline
check_001
89.23.96.50:36689
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e72d130901090a952719c918c2f288b63af9ab7d413efaf9c8c26f875f25eb9f
Files
-
e72d130901090a952719c918c2f288b63af9ab7d413efaf9c8c26f875f25eb9f.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ