Behavioral task
behavioral1
Sample
0x000900000002326b-109.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0x000900000002326b-109.exe
Resource
win10v2004-20231023-en
General
-
Target
0x000900000002326b-109.dat
-
Size
223KB
-
MD5
f75eecc9fc86a09b134eaf10d4cb0d9c
-
SHA1
57f6cd5a1f66505f500f3e7ab8957d2a31e40fb8
-
SHA256
cd26e02c5fd2fea6daa2877aedc63312fe40e3d2ec4a0a1b9f8785b992914695
-
SHA512
d2f4587bf3578c4ca7ea4248de167ab871ff21787fb16017cbcfa387f3372d586d78464443916f6cbdf7c6a04a0ab271aa2ee3f2642d0e3f279a73b21004d358
-
SSDEEP
3072:TtJXRMeZYncNgckxQdxCr1d2t/q5yoQVZL53pRzzXZQAZ:TJMeucNgckedxCDo/doQVZdZRzzXZQ
Malware Config
Extracted
redline
kukish
77.91.124.55:19071
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x000900000002326b-109.dat
Files
-
0x000900000002326b-109.dat.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ