Behavioral task
behavioral1
Sample
f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9.exe
Resource
win10v2004-20240709-en
General
-
Target
f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9.exe
-
Size
298KB
-
MD5
65f8fcab7cfe7aecbdd653d2ec0837ed
-
SHA1
ea9596a2624d5790c2bc4df8a68cfa0f058e6b29
-
SHA256
f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9
-
SHA512
65629bb0bc600bc16536d0ea776ced3d237119553b0dac88d35867e08bf0e89500003b4a1323a0fa716a1de01aa870aeb2ec6479174dfd08be798f1bc7e41f67
-
SSDEEP
3072:LqFFrqwIOGZ0yU4F4xEelxtwRXpd1s0smqhdPQTZSfHCRcZqf7D34deqiOLCbBOU:WBIOGavwUmkdYTZMqcZqf7DInL
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
77.105.135.107:3445
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9.exe
Files
-
f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ