Behavioral task
behavioral1
Sample
7e66832e7838a1c4866790097195b7c6fa1d48de72c942ab8d5e1aaac65e9b85.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7e66832e7838a1c4866790097195b7c6fa1d48de72c942ab8d5e1aaac65e9b85.exe
Resource
win10v2004-20241007-en
General
-
Target
7e66832e7838a1c4866790097195b7c6fa1d48de72c942ab8d5e1aaac65e9b85
-
Size
300KB
-
MD5
8195e2849cfb9432914e061bb2ad7be8
-
SHA1
aa5a8666b410066c9c7a50a38552b3274aac6549
-
SHA256
7e66832e7838a1c4866790097195b7c6fa1d48de72c942ab8d5e1aaac65e9b85
-
SHA512
833308f50689feafd23e310e76122c37934097da9324338b99cbfdd43fd19b2c1d62ee205e86fc3c20f7cff00583f76e05dfc39916ba06f73d37db34d600d935
-
SSDEEP
6144:2ZCj72YsViYqG0LahyD8FU3+It/oEzkiOqFk8eAU:97s8/5Z5FD
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
SectopRAT payload 1 IoCs
resource yara_rule sample family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7e66832e7838a1c4866790097195b7c6fa1d48de72c942ab8d5e1aaac65e9b85
Files
-
7e66832e7838a1c4866790097195b7c6fa1d48de72c942ab8d5e1aaac65e9b85.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ