Behavioral task
behavioral1
Sample
b1309d691e19475051caa2f1346d2f7a23706bca559852d8c420f3f8fbcb557f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b1309d691e19475051caa2f1346d2f7a23706bca559852d8c420f3f8fbcb557f.exe
Resource
win10v2004-20240508-en
General
-
Target
b1309d691e19475051caa2f1346d2f7a23706bca559852d8c420f3f8fbcb557f.exe
-
Size
297KB
-
MD5
6e1166af854364a8668e80049abf4cca
-
SHA1
0832bab61321ec1b2998e7dc99b807c5d51ba5b7
-
SHA256
b1309d691e19475051caa2f1346d2f7a23706bca559852d8c420f3f8fbcb557f
-
SHA512
97074c4441dc487b8d398008537ad6f6e77a5c90a75277e76b59a2c785b47e61ec313c9f946c14d5689c2463e1604baaec18a72e37ec098feece9d29d5e6f3a5
-
SSDEEP
3072:hqFFrqwIOGdTypEmz07s6iCa5hWi/ML6QuhdjETZ2fHgycZqf7D34deqiOLCbBOJ:ABIOG6OiWadATZQzcZqf7DInL
Malware Config
Extracted
redline
xXx
185.236.228.125:15140
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1309d691e19475051caa2f1346d2f7a23706bca559852d8c420f3f8fbcb557f.exe
Files
-
b1309d691e19475051caa2f1346d2f7a23706bca559852d8c420f3f8fbcb557f.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ