Behavioral task
behavioral1
Sample
22a42f72a83cdd97c47fffe53311a9dd7acb213acb809e1106f6f1ebae37cf47.exe
Resource
win7-20240220-en
General
-
Target
22a42f72a83cdd97c47fffe53311a9dd7acb213acb809e1106f6f1ebae37cf47
-
Size
172KB
-
MD5
542728b0adfdcd5734bdcb99a2f605cf
-
SHA1
29c57a009b0af644a059644fc08c13e770f14bbf
-
SHA256
22a42f72a83cdd97c47fffe53311a9dd7acb213acb809e1106f6f1ebae37cf47
-
SHA512
046b50fd457f98999a5dff716abfd5f6871083a74dcf667b370ed6fdcdd9f7a7bd0ab6f3ac671ef0c13bca8a21a32a843c703d58adbdad1fbf1e8a63294a5f24
-
SSDEEP
3072:FqaJm74qpXtmOnJjBawT253uaxfKfVvXgDOL3DhpPL0F0JCb3O3Cb3hRsRQEcC8X:1sfHvcyh
Malware Config
Extracted
redline
45.15.157.131:36457
-
auth_value
e7bf901b8e6b088c010d95efb1cecee1
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22a42f72a83cdd97c47fffe53311a9dd7acb213acb809e1106f6f1ebae37cf47
Files
-
22a42f72a83cdd97c47fffe53311a9dd7acb213acb809e1106f6f1ebae37cf47.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ