Behavioral task
behavioral1
Sample
0x0007000000022d88-482.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0x0007000000022d88-482.exe
Resource
win10v2004-20231020-en
General
-
Target
0x0007000000022d88-482.dat
-
Size
270KB
-
MD5
3c4bb3d9db49aae5411f621feefbd11a
-
SHA1
41100f837ba38caec87f7762492c37a840fed3d5
-
SHA256
d647c0772c1c31dfd77667cada479351ff53c38c29bb2c1a3b873a6b331a30e9
-
SHA512
d10cdecdf3164988218a7288503a4bca369e09822b5711c756317aba4f88f0622bf342542eb2343b0c3635c312cd6a7c4626de13a977089d30b11aab6f6b2c0d
-
SSDEEP
6144:oy5OCk7UNgc02rIDoE4E0OA1Siif+Sg56zOun0SR2Xk+ny6nW:oygkNgc02r2cif+SgdutR2XkdSW
Malware Config
Extracted
redline
LiveTraffic
195.10.205.16:1056
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0x0007000000022d88-482.dat
Files
-
0x0007000000022d88-482.dat.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ