Behavioral task
behavioral1
Sample
6b1033fe52474e9938f41e536c69e190f586adf97508b70473860272b2dc1729.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
6b1033fe52474e9938f41e536c69e190f586adf97508b70473860272b2dc1729.exe
Resource
win10v2004-20240704-en
General
-
Target
6b1033fe52474e9938f41e536c69e190f586adf97508b70473860272b2dc1729.exe
-
Size
433KB
-
MD5
286954cfb226c9f6a2e509b169d7bb2e
-
SHA1
afec3786d481b68a560cd58b47a0dd3728b02f8c
-
SHA256
6b1033fe52474e9938f41e536c69e190f586adf97508b70473860272b2dc1729
-
SHA512
1c91a45f2c69f7a024d3406eb761cc5d4ddebdba008e0d007a34b90d60fcfa6c193563b1bcca192828a4981eff9cf289dc76b6978654c4360f35b80184399736
-
SSDEEP
6144:NWtMKz49H6zgtfT7tpE3gq46DZ/mkmEq4RRbZGky847ecW:83z4gAnE3FPNUObkky17ec
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b1033fe52474e9938f41e536c69e190f586adf97508b70473860272b2dc1729.exe
Files
-
6b1033fe52474e9938f41e536c69e190f586adf97508b70473860272b2dc1729.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 270KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ