Behavioral task
behavioral1
Sample
32fb211c16337105d3ca000488b4248ec7d7f4118715fc9bbfab5b1cad364541.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
32fb211c16337105d3ca000488b4248ec7d7f4118715fc9bbfab5b1cad364541.exe
Resource
win10v2004-20240508-en
General
-
Target
32fb211c16337105d3ca000488b4248ec7d7f4118715fc9bbfab5b1cad364541.exe
-
Size
297KB
-
MD5
9f25d8cad4e2939c33c78e4c514bbc6a
-
SHA1
88a7a6f216ace34587a2fc0cccdb2d25eceddcdc
-
SHA256
32fb211c16337105d3ca000488b4248ec7d7f4118715fc9bbfab5b1cad364541
-
SHA512
851fba57b0fcd09fd95e36ee7706e20099d92fef003c43edb964b2f26316623a7a750930dc97fa0c3e3e7dddc677a9e0728eec61deefdd43b563283921f47707
-
SSDEEP
3072:DqFFrqwIOGz9yXEyvmjAgKPRxDoDhdaFO8ZBfHIQcZqf7D34NeqiOLCbBOV:eBIOGcmKPwdeO8ZtVcZqf7DI3L
Malware Config
Extracted
redline
N2
149.28.222.15:44506
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32fb211c16337105d3ca000488b4248ec7d7f4118715fc9bbfab5b1cad364541.exe
Files
-
32fb211c16337105d3ca000488b4248ec7d7f4118715fc9bbfab5b1cad364541.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ