Behavioral task
behavioral1
Sample
041bf8121f0b162298d5586cb420fdf5fd09b9fb8b497906f8616e53a76607c7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
041bf8121f0b162298d5586cb420fdf5fd09b9fb8b497906f8616e53a76607c7.exe
Resource
win10v2004-20240508-en
General
-
Target
041bf8121f0b162298d5586cb420fdf5fd09b9fb8b497906f8616e53a76607c7
-
Size
94KB
-
MD5
5cc66fc0009faaa302fe725f58972c36
-
SHA1
8cfb1792385ac13ccd796134bf0ca6f900a44979
-
SHA256
041bf8121f0b162298d5586cb420fdf5fd09b9fb8b497906f8616e53a76607c7
-
SHA512
3cde9ebaecfa21258b8f84bf59ffb63d03e326dc8cac3325996d2cf0d37878229a90d5789d7c1aaf17bf4cfd2f945805aa231d5cc6231f1a8fb16eb76acb8b8d
-
SSDEEP
1536:9ATp9NZjE6oljj9tAtzZM4YCrB/atqgdbibEB/l2kPoSG2:9ATp9DOjj9tA5C4JJatvqEhfr
Malware Config
Extracted
redline
5129512298_99
https://pastebin.com/raw/tnW31tPp
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 041bf8121f0b162298d5586cb420fdf5fd09b9fb8b497906f8616e53a76607c7
Files
-
041bf8121f0b162298d5586cb420fdf5fd09b9fb8b497906f8616e53a76607c7.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ