Behavioral task
behavioral1
Sample
BF63E78C897D77BB149AC08DCDF1A388.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
BF63E78C897D77BB149AC08DCDF1A388.exe
Resource
win10v2004-20240709-en
General
-
Target
BF63E78C897D77BB149AC08DCDF1A388.exe
-
Size
384KB
-
MD5
bf63e78c897d77bb149ac08dcdf1a388
-
SHA1
bb22dd246ea3f321b76adb327c6c2e3ddb593ee7
-
SHA256
55baf3a8ef941e7072371c5900349a9ec3d98086333dbf1a2a5ecd17b9f702fa
-
SHA512
20da333fa764c0c5926960ed4ce5b8034e57b9f65ba21ebea68865711a9574c4b8915b2b548cf0294fc81e5706c2f1b55a0fa98dca638b9508084e7eeadf1631
-
SSDEEP
3072:sGxUApppzIOS01uZ4ZgsMzEUcd+nnqKDT0pOYVYaPQle1we3ALOMpMYfjCbwc:9xB7hI61u2ZvtTd4nqKDUPQle0zhfjC
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BF63E78C897D77BB149AC08DCDF1A388.exe
Files
-
BF63E78C897D77BB149AC08DCDF1A388.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 270KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ