Behavioral task
behavioral1
Sample
0x000900000002316c-297.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0x000900000002316c-297.exe
Resource
win10v2004-20231020-en
General
-
Target
0x000900000002316c-297.dat
-
Size
221KB
-
MD5
0dfaef8048c31d51e2ee62ad91144035
-
SHA1
534b7854124647e4e80033c7d06e7418977d779e
-
SHA256
bbc4c87c8de1f931dec28aa4b13b1997c5f290de002d07a08877d741d3d4fe5a
-
SHA512
58a64b92f2f1c1cb2793b3eb1b0a5f2dfcb04ac39c2a59b06de0970df2d0ce5724f2474cabb047ef830b616fe410fe0329d2f19ee6ac177209a5aa01b594296a
-
SSDEEP
3072:TtJXRMeZYncNgckxQdxCr1d2t/q5yoQVZL53pRzzXZQAZ:TJMeucNgckedxCDo/doQVZdZRzzXZQ
Malware Config
Extracted
redline
kukish
77.91.124.55:19071
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x000900000002316c-297.dat
Files
-
0x000900000002316c-297.dat.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ