Behavioral task
behavioral1
Sample
6ebc8a2473b29644c6442365ae83be9681bba9c2f0aa16855bf777d7c955d07a.exe
Resource
win7-20240221-en
General
-
Target
82f76906a4ba450daf0d1a3827ee8a0f.bin
-
Size
43KB
-
MD5
f8e6385e3b993b0db05d318cba8f3a10
-
SHA1
c09e9f00a4820d23e86e27ad847e77b9f50be5cb
-
SHA256
4780f1ff1f94fec027fbbac25aef7061c737df65d31270e7290e40488a6b355a
-
SHA512
2ebcfe9ad547873f3726b962f2152488b0e6d07909e6e08227946d4390cc42819aa38e31237309bb497674ec00eef92770c66de9c7b4340e143ca82fc3e4ff17
-
SSDEEP
768:Eh2czkoCF78Dq1lYeQ+myCB9vGLq9P7Tj5lPm8Dnc2P+D7Q4B0+SfNftJlVAvflA:Eh2xH14+mysGLqhjjO842GDw+i1tglA
Malware Config
Extracted
redline
TEST
142.202.242.172:30098
Signatures
-
RedLine payload 1 IoCs
resource yara_rule static1/unpack001/6ebc8a2473b29644c6442365ae83be9681bba9c2f0aa16855bf777d7c955d07a.exe family_redline -
Redline family
-
SectopRAT payload 1 IoCs
resource yara_rule static1/unpack001/6ebc8a2473b29644c6442365ae83be9681bba9c2f0aa16855bf777d7c955d07a.exe family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6ebc8a2473b29644c6442365ae83be9681bba9c2f0aa16855bf777d7c955d07a.exe
Files
-
82f76906a4ba450daf0d1a3827ee8a0f.bin.zip
Password: infected
-
6ebc8a2473b29644c6442365ae83be9681bba9c2f0aa16855bf777d7c955d07a.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ