Behavioral task
behavioral1
Sample
665257d2e600180970af272d6ec682ec1a42959de375813a3f358efce8f2458c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
665257d2e600180970af272d6ec682ec1a42959de375813a3f358efce8f2458c.exe
Resource
win10v2004-20240508-en
General
-
Target
665257d2e600180970af272d6ec682ec1a42959de375813a3f358efce8f2458c.exe
-
Size
298KB
-
MD5
b7ef46030488cc9077ee3aee05019001
-
SHA1
a9ef730de2589b8c7103c181ea3e794ae3c52698
-
SHA256
665257d2e600180970af272d6ec682ec1a42959de375813a3f358efce8f2458c
-
SHA512
f554ec4b1524869bfa0efdedb810aba7dea37feb1d7f6487059fc630fdecf5ea153eb422dce5583908ab840335a0e0860e547b7c33113b4966fff8297dfcb317
-
SSDEEP
3072:NqFFrqwIOGtwygmQZweFapa4jdbJbYk0naVbhd4mTZbeHg/cZqf7D34teqiOLCbM:kBIOG2yAWUCdlTZSKcZqf7DIXL
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
5.42.65.129:2353
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 665257d2e600180970af272d6ec682ec1a42959de375813a3f358efce8f2458c.exe
Files
-
665257d2e600180970af272d6ec682ec1a42959de375813a3f358efce8f2458c.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ