Behavioral task
behavioral1
Sample
774a1784cb6de5887eaf953adc1c604d89784ad3f48484a3be931b205d1eb54b.exe
Resource
win10v2004-20231215-en
General
-
Target
774a1784cb6de5887eaf953adc1c604d89784ad3f48484a3be931b205d1eb54b
-
Size
301KB
-
MD5
fb95da8e2b70c03b780e71a1d08039b7
-
SHA1
a10d69ba6482e965a26e3117798c88999e209619
-
SHA256
774a1784cb6de5887eaf953adc1c604d89784ad3f48484a3be931b205d1eb54b
-
SHA512
0cdd413ffbcc3d7c4ea634d60bba689ffb1108513db5631e60399c048dcfb3c3d5cfec46d983e03e1bbfb86bb4f990d00e614957d0572f2ec7e94d9a8c815e45
-
SSDEEP
3072:gqK8kKqcIkCd6kTfZjTHlvVy0r6TZnML/JcZqf7D34leqiOLCbBOg:jBkKqLdZjTHbuTZMVcZqf7DIvL
Malware Config
Extracted
redline
jok
185.215.113.67:26260
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 774a1784cb6de5887eaf953adc1c604d89784ad3f48484a3be931b205d1eb54b
Files
-
774a1784cb6de5887eaf953adc1c604d89784ad3f48484a3be931b205d1eb54b.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ