Behavioral task
behavioral1
Sample
df024360066a06a1b84fd5eb539df2a0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df024360066a06a1b84fd5eb539df2a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
df024360066a06a1b84fd5eb539df2a0N
-
Size
300KB
-
MD5
df024360066a06a1b84fd5eb539df2a0
-
SHA1
47caabc1282685dc0cc51e099d72142fc5b48041
-
SHA256
099a01d98bed966ca6de2b18bfd2a1659352a07ca68d38599f538d71d6e1511e
-
SHA512
e1f5e9d1a9e9899c1fa94d497175eba185646b8f5993c3b23edabd5349c46a00e194798f39355ccb167cdccfb8bb7bea851e4bc127ca54cd24039c74f202166a
-
SSDEEP
3072:9cZqf7D34up/0+mAmkyY8sQwg6CQB1fA0PuTVAtkxzsv13RUeqiOL2bBOA:9cZqf7DIWnAHjQB1fA0GTV8kexcL
Malware Config
Extracted
redline
Glock
51.11.214.78:1912
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df024360066a06a1b84fd5eb539df2a0N
Files
-
df024360066a06a1b84fd5eb539df2a0N.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ