Behavioral task
behavioral1
Sample
0x0006000000015c8b-116.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0x0006000000015c8b-116.exe
Resource
win10v2004-20231023-en
General
-
Target
0x0006000000015c8b-116.dat
-
Size
219KB
-
MD5
37459d179e70c389b5472f58cdc312e8
-
SHA1
eade40066266761afa2035e55f89d576ee8c8810
-
SHA256
5759ab329375d6afe2ded6f14fe28e6fc32e6ea1b6c9c1afd3f8497ce0bc1c0d
-
SHA512
7aa809f7dc5f336d49cc2d383e75350aad2a1b6baab4308d2eb25feffc216f03bcb54f3c2db7e953b7bcf15b7aee9b377350566055e9e0e5ee6320d06ce4d5f3
-
SSDEEP
6144:neT7M7zNgcEgkrbVNurQ+9/Ac0NV1SE561FJ:QCNgcEjryV4cA561FJ
Malware Config
Extracted
redline
kedru
77.91.124.86:19084
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x0006000000015c8b-116.dat
Files
-
0x0006000000015c8b-116.dat.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ