Behavioral task
behavioral1
Sample
50b71b926697f9fea0ddd08f53172cb2.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
50b71b926697f9fea0ddd08f53172cb2.exe
Resource
win10v2004-20231023-en
General
-
Target
50b71b926697f9fea0ddd08f53172cb2.bin
-
Size
240KB
-
MD5
50b71b926697f9fea0ddd08f53172cb2
-
SHA1
566c08d8ae6ec068e1588dbab3d33ec73a812c0f
-
SHA256
3ba68cb97a8e9a0fdefe2853f89bda22e86971b4d9bb07cf6f4ebcbc32c8bd67
-
SHA512
edc89b68add0d26b59784c8b2f125e669980084167529941d62daa43e0b7dbb48e6e229633289b99ef968803ae2953848ad8dea1708daaa49527ea1781a32548
-
SSDEEP
6144:rrzkuv7SNgcD8rPEsCxG90EY1SGSI11AK:rPsNgcD8r/CSI11AK
Malware Config
Extracted
redline
LogsDiller Cloud (Telegram: @logsdillabot)
194.49.94.181:40264
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50b71b926697f9fea0ddd08f53172cb2.bin
Files
-
50b71b926697f9fea0ddd08f53172cb2.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ