Behavioral task
behavioral1
Sample
bf8348eadfe7b5422f5aa4f9cac5c87b47dd01dedbf579f7c8cbf277a6fdb470.exe
Resource
win10v2004-20240412-en
General
-
Target
bf8348eadfe7b5422f5aa4f9cac5c87b47dd01dedbf579f7c8cbf277a6fdb470
-
Size
304KB
-
MD5
c89397ff1112462c091987ad6f805430
-
SHA1
52cb51d06d8bedbf0ed6449c7b64c8329b6d686b
-
SHA256
bf8348eadfe7b5422f5aa4f9cac5c87b47dd01dedbf579f7c8cbf277a6fdb470
-
SHA512
75413bea98df5a06fbe24a9a7a7a10eb6aee29280c1e0653c930f411353768766e1761898c7e79fc0f3d34f52954a31734a75ebca5d602e3e300cf400c95fc5a
-
SSDEEP
6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Malware Config
Extracted
redline
spoo
103.113.70.99:2630
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf8348eadfe7b5422f5aa4f9cac5c87b47dd01dedbf579f7c8cbf277a6fdb470
Files
-
bf8348eadfe7b5422f5aa4f9cac5c87b47dd01dedbf579f7c8cbf277a6fdb470.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ