Behavioral task
behavioral1
Sample
bc2d9de97c7cf4c2b9781a129795cd4a79f80ed0892c73e4f9a22c5766892353.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
bc2d9de97c7cf4c2b9781a129795cd4a79f80ed0892c73e4f9a22c5766892353.exe
Resource
win10v2004-20231023-en
General
-
Target
000619cb5b012c1e7c9810a3d98f8684.bin
-
Size
131KB
-
MD5
d2cfe094265b4fde0b6a72ba5b99b168
-
SHA1
8109bbff32b6fad713da1dcd6887770df8cb236a
-
SHA256
f1adb5f5671c3082bf586a76879cbc0e27c014fc5a9f4c8f761a8961a3ed1c05
-
SHA512
e2731bf0d25ac59ab4f4904050beaa706c9ba7508fa2078d0893c21205593c5bee3acb79591d61e21f2515eb702fdb2037b58d37226ee206e1046b9ff5dce8bf
-
SSDEEP
3072:3J5VkIt1mw4JwL1+tD5XB6LpJAWwUD08LOIZ7EoXkmX:/GIthmLtD5XSJAYZfVxX
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule static1/unpack001/bc2d9de97c7cf4c2b9781a129795cd4a79f80ed0892c73e4f9a22c5766892353.exe family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bc2d9de97c7cf4c2b9781a129795cd4a79f80ed0892c73e4f9a22c5766892353.exe
Files
-
000619cb5b012c1e7c9810a3d98f8684.bin.zip
Password: infected
-
bc2d9de97c7cf4c2b9781a129795cd4a79f80ed0892c73e4f9a22c5766892353.exe.exe windows:4 windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ